text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, tests on our systems, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including an information technology consultant, to enhance our cybersecurity oversight.

companyName: Vivakor, Inc.

ticker: VIVK


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

secItem: Item 1C


text: Our informational technology consultant leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our informational technology consultant has over 34 years of experience working with companies in the information technology field.

stage1Category: Management Role

stage1Method: unanimous


text: We are working with our information technology consultant to help improve our overall cybersecurity and plan to take any necessary steps to protect our information assets and operations from internal and external cyber threats in the event any such steps are recommended.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: We are committed to safeguarding our information systems and data from potential cyber threats. Our cybersecurity measures include comprehensive policies, continuous monitoring, regular security assessments, and employee training programs to mitigate risks and enhance our defenses against cyber incidents. We have not experienced any material cybersecurity breaches to date.

companyName: KB Global Holdings Ltd

stage1Category: Risk Management Process


text: Risk Management, and Strategy recognizes the importance of identifying, assessing, and managing risks associated with cybersecurity threats. Rubicon's approach to risk management starts with assessing the likelihood and impact of a potential or known risk. Rubicon focuses on substantiating each identified risk by classifying its risk rating and residual risk, followed by categorizing the risk with two (2) additional criteria.

companyName: Rubicon Technologies, Inc.

stage1Method: majority


text: First, we assess if the risk is related to our overall cybersecurity program, business continuity, privacy compliance, or financial risk. Second, we designate a strategy for each identified risk, including acceptance, avoidance, transference, and mitigation.


text: cybersecurity program is built around the Service Organization Control Type 2 (SOC 2) standards established by the Assurance Services Executive Committee (ASEC) of the American Institute of Certified Public Accountants (AICPA). The cybersecurity program is independently assessed through the SOC 2 audit process. Additionally, we have developed and implemented a Business Continuity Management System (BCMS) which has been certified against the International Organization for Standardization (ISO) 22301:2019 standard. Rubicon's program encompasses a series of policies and controls to prevent, detect, and respond to threats and incidents. Policies and controls include, but are not limited to, identity access management, employee awareness and training, change management, privacy, continuity and resiliency, incident management, security operations, endpoint security, data classification and handling, and third-party risk management.


text: Rubicon employs the use of third-party services to support continuous cybersecurity and network monitoring. Specifically, these third-parties provide managed detection and response, as well as incident response and readiness services. The cybersecurity team manages routine internal auditing, penetration testing, vulnerability scanning, exercising and training, third-party assessments, and policy enforcement. Board of Directors, through the Audit Committee, is responsible for the independent oversight of Rubicon's cybersecurity program.


text: The duties and responsibilities of the Audit Committee can be found in the Audit Committee Charter, which is located on our investor relations website. Members of the management team report to the Audit Committee, which reports to the entire Board of Directors about cybersecurity risk at least annually. In addition, in accordance with Rubicon's incident response procedures, the Board of Directors is informed of any potentially material cybersecurity incidents upon discovery and classification of a cyber incident if the incident meets Priority One Status ("P1") and has potential for data loss, loss of service(s) greater than that of any defined service level agreement, or may or does require breach notification. All lower level incidents are reported annually, or as needed to the Audit Committee.

stage1Category: Board Governance


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risk.

companyName: Protopia Global Holdings Inc.


text: cybersecurity program is managed by a dedicated team lead by our Vice President of Cybersecurity, who is responsible for deploying and maintaining cybersecurity operations through the use of people, processes, and technology. Rubicon's cybersecurity team leverages industry standards and industry-recognized best practices. Any incident, either assumed or actual, is escalated for further review as soon as practicable, and then reported to designated members of the executive leadership team pursuant to Rubicon's established incident management procedures.


text: designated Chief Information Security Officer ("CISO") is responsible for overseeing the performance of our cybersecurity program in partnership with our Chief Executive Officer ("CEO"). Our Vice President of Cybersecurity reports to the CISO.


text: The CISO and CEO receive routine updates regarding current operations, threats, and industry trends. Findings from independent auditors as well as findings from internal audits and any penetration testing are presented to the CISO and CEO and corrective action is prioritized, where applicable.


text: 2023, Rubicon did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our strategies, operations, or financial condition. Rubicon cannot eliminate all risks from cybersecurity threats or other related risks or provide guarantees or assurances that we have not experienced undetected cybersecurity incidents. To that end, however, we believe cybersecurity is the responsibility of all related parties to our business.

stage1Category: Strategy Integration


text: Risk Management Program As part of the information security program, CX App has a risk management program that continuously engages in the process of identifying, evaluating, and treating risks around the organization's valuable information. It addresses uncertainties around information assets to ensure the desired business outcomes are achieved. CX App performs annual Risk Assessments (RAs) to determine security risks in corporate operations, products, and services, and initiates appropriate remediation.

companyName: CXApp Inc.

ticker: CXAI


text: CXApp's information security program is aligned with business objectives that establish rules governing how to identify risks, assign risk ownership, how the risks impact the confidentiality, integrity and availability of the information and the method of treatment for identified risks. A formal risk assessment methodology is approved by management.


text: The risk management framework includes guidelines for identifying and estimating the cost of protective measures to eliminate or reduce the security risks to an acceptable level.


text: All operations, products, services, information assets and information systems that are owned and operated by CXApp are assessed for risks that result from threats to the integrity, availability, and confidentiality of CXApp's data.


text: Identification of Strategic Objectives: The alignment of strategic objectives and risk management to avoid siloed risk management approach. This is the key step in performing risk assessments.


text: Identification of Risks: A continuous effort to identify which risks are likely to affect the CXApp's strategic objectives and consequently security functions and business continuity of CXApp and documenting their characteristics. Analysis of Risks: An estimation of the probability (likelihood), impact, and prioritization of risks relative to each other.


text: Mitigation Planning: Decisions and actions that will reduce the impact of risks as well as limit the probability of their occurrence or improve the response to a risk occurrence.

stage1Category: None/Other


text: Tracking and Controlling Risks: Collection and reporting of status information about risks and their mitigation plans, response to changes in risks over time, and management oversight of corrective measures taken in accordance with the mitigation plan.


text: As part of the risk management program, responsibility is assigned to Information Technology (IT) Department, systems owners, department managers, and executive management.


text: Management's Role in Managing Risks IT Department is responsible for conducting a risk assessment as well as prioritizing, implementing, and maintaining the appropriate risk-reduction measures defined in the risk assessment process.


text: Risk owners are the individuals who are ultimately accountable for ensuring the risk is managed appropriately. There may be multiple personnel who have direct responsibility for or oversee activities to manage each identified risk and collaborate with the accountable risk owner in his/her risk management efforts. Responsibilities for the continued development, implementation, and maintenance of the risk management program are also assigned internally to IT.


text: Risk Management and Strategy Following the March 2024 Private Placement, our focus has been on the identification of a privately held company to complete a reverse merger or similar strategic transaction. While we continue to maintain minimal distribution, marketing, and sales support, we have scaled down operations to the core functions of a U.S. Nasdaq listed company to conserve cash and focus on the functions needed to pursue potential strategic alternatives. We have implemented risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection/onboarding process and a review of SOC 1 reports on an annual basis.

companyName: CapForce Inc.

ticker: OPGN


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized IT providers leveraging third-party technology and expertise. These third-party service providers are a key part of our current cybersecurity risk management and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols and critical data backups. Our outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems and has implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition. In addition, we carry insurance with coverage for cyber events that we believe is suitable for a company of our size, stage of growth and financial condition.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors and Audit Committee has responsibility for the oversight of risk management, including risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology, including cybersecurity risks. Member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, emerging threat landscape and new cyber risks, and provide updates on our processes to prevent, detect, and mitigate cybersecurity incidents.


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats, and have not experienced any cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition.


text: For additional information concerning risks related to cybersecurity, see Item 1A. Risk Factors: Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.


text: The Company's risk management program includes governance through the cybersecurity committee, consisting of senior executive management team along with legal and other key holders. Our Enterprise Risk Management lead is tasked with integrating any cybersecurity risk considerations into overall risk management strategy. Risk management includes regular risk assessments to identify internal and external risks and to evaluate the magnitude of harm that could arise out of such risks. Further, risk management may utilize third party service providers where complementary and supplementary to the Company's overall business strategy. Lastly, risk management includes training and education over the continuously evolving landscape of cybersecurity threats. We engage external parties, including consultants, independent privacy assessors, computer security firms, training service providers and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consult with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the ISO 27001, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), and other relevant standards.

companyName: Aeries Technology, Inc.

ticker: AERT


text: Given the nature and limited scale of our operations, we do not maintain a formal cybersecurity program, dedicated cybersecurity personnel, or standalone cybersecurity policies. Our business does not involve the development, storage, or processing of sensitive personal data, proprietary technology, or large volumes of confidential information.

companyName: Bodhi Tree Biotechnology Inc

ticker: BDTB


text: Material effects of cybersecurity threats Although cybersecurity risks have the potential to affect the business, financial condition, and results of operations, we do not believe that risks from attacks, including results from any previous cybersecurity incidents or threats, have materially affected or likely to materially affect our strategy, operations or financial condition. However, no matter how well controls or designed or how well cybersecurity risk management procedures are implemented, there can be no full assurance given that risk remains of an incident that could cause material harm to the business. See " Our business relies heavily on owned and third-party technology and computer systems, which subjects us to various uncertainties " in the section entitled " Risk Factors ".


text: Governance and Management Our board of directors addresses our cybersecurity risk management as part of its general oversight function. As part of the Board's oversight, the Board will receive a report at least annually from our cybersecurity committee, covering updates on our cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape.


text: Our cybersecurity committee plays an active role by meeting periodically to review the status of the Company's cyber security program and roadmap for new cybersecurity risk management initiatives. The committee oversees cybersecurity risk management by evaluating whether management has robust cybersecurity policies and procedures, regularly assessing and monitoring cybersecurity risks, and receiving regular reports on the Company's cybersecurity posture. The Cybersecurity Committee holds monthly review meetings, to discuss the status of the Company's Cybersecurity posture, plans and projects underway, and to discuss any changes in existing policies and procedures.


text: Our cybersecurity risk management processes are devised, implemented and assessed quarterly by our Cybersecurity lead, Enterprise Risk Management lead and Head of IT Strategy and Solutions. Our leads have extensive experience in cybersecurity and information technology, and based on their careers, have a deep understanding of our information technology and business needs. Our leads report to the cybersecurity committee monthly regarding emerging risks and the overall cybersecurity environment and immediately when a cybersecurity incident occurs. Our IT heads and Cybersecurity lead closely monitor cybersecurity risks, including our practices and procedures against the cybersecurity environment, including the operation of our incident response plan. Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We strongly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program. This includes receiving quarterly exercises, cyber-event simulations, training programs and incorporating our Technology Acceptable Use Policy into onboarding and training materials.


text: Cybersecurity Risk Management and Strategy Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program, which we endeavor to align with industry standards. We have key Company policies and practices that directly or indirectly relate to cybersecurity matters, including policies and practices relating to antivirus protection, remote access, multifactor authentication, restricted access based upon business need and confidentiality of information, as well as procedures designed to reduce phishing, increase employee awareness of phishing attempts and other activities. The key elements of our efforts to identify, prevent, mitigate, and remediate cybersecurity risks and incidents through our cybersecurity risk management program include:

companyName: Airspan Networks Holdings Inc.


text: We collect and analyze information about cybersecurity risks as part of our risk management program and monitor and discuss public alerts, threat levels, trends and remediation. All employees receive periodic cybersecurity training designed to educate concerning the recognition of cybersecurity threats.


text: Employees are obligated under the terms of our IT Appropriate Use Policy to protect IT assets from attack and to maintain proper control of access to IT systems and passwords.


text: We use various security tools, including internal reporting and monitoring, to identify vulnerabilities in our products and systems. We use industry leading products and services within our IT environment to optimize security and under vendor contracts. Regular system updates and patching are done to protect our hardware and software against security vulnerabilities.


text: In certain limited situations we allow third party suppliers to access certain areas of our systems. In such cases third party access is strictly minimized and supervised to optimize security and control.

stage1Category: Third-Party Risk


text: We have controls and procedures in place for prompt escalation of cybersecurity incidents and periodically evaluate and update contingency planning, including capability to recover in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. We conduct penetration testing to test our defenses and monitor threat levels.


text: We experience cyber-attacks and other attempts to gain unauthorized access to our systems on a regular basis, and we anticipate continuing to be subject to such attempts. Despite our implementation of security measures, (i) our products and services, and (ii) the servers, data centers, and cloud-based solutions on which our and third-party data is stored, are vulnerable to cyber-attacks, data breaches, malware, and disruptions from unauthorized access, tampering or other theft or misuse, including by employees, malicious actors or inadvertent error. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Cybersecurity risk is part of management's risk oversight, although periodic reports are made to the Board of Directors of management's implementation and monitoring of our cybersecurity risks programs. Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. Management will update the Board, as necessary, regarding any significant cybersecurity incidents should they occur, so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: Our information technology team, which has overall responsibility for cybersecurity, is led by our Vice President, Global IT, who, has a Masters Degree in Philosophy, Politics and Economics from Oxford University and 32 years of experience in information technology management, and who reports to our Senior Vice President and CFO. Our cybersecurity management team draws from expertise in our information technology, information security, finance, legal, impacted product teams or product management personnel and other departments as needed. This team is responsible for assessing and managing our material risks from cybersecurity threats and our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants.


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risk.


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, patient information, sensitive third-party information and employee information. To protect this information, our existing cybersecurity policies require continuous monitoring and detection programs, network security precautions, encryption of critical data and in-depth security assessments of vendors. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We have established and regularly test our disaster recovery plan, and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess the effectiveness of our data security practices. Our information technology (" IT ") team is responsible for these ongoing monitoring and detection activities.

companyName: Zeo ScientifiX, Inc.

ticker: ZEOX


text: The governance of our cybersecurity risks involves active and informed participation from our management team, our IT team and our board of directors. This oversight includes briefings by our IT team on the nature of the risks we face and the steps we are taking to mitigate these risks, as well as immediately reporting any significant cybersecurity incident that occurs to management and the board of directors.


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there are any. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Black Hawk Acquisition Corp

ticker: BKHA


text: We are a blank check company with no business operations. Since the IPO, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.

companyName: Legato Merger Corp. III

ticker: LEGT


text: To date, we have not experienced any cybersecurity attacks. However, any such attack could adversely affect our business. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance. We may in the future engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our existing cybersecurity processes.


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates for business combination. Therefore, we do not consider that we face significant cybersecurity risks.

companyName: Future Vision II Acquisition Corp.

ticker: FVN


text: We have not adopted any cybersecurity risk management program or formal procedures for assessing cybersecurity risks. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our Board for further actions, including the implementation of mitigation measures or other response or actions that the Board deems appropriate to take.


text: Since the completion of our initial public offering and as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity threats that have materially affected, or that we believe are reasonably likely to materially affect, us, including our business strategies, results of operations, or financial condition.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Aura Fat Projects Acquisition Corp


text: We maintain an information security program and governance framework that is designed to protect our information systems against operational risks related to cybersecurity.

companyName: Nexalin Technology, Inc.

ticker: NXL


text: Our Board of Directors is primarily responsible for overseeing and governing our cybersecurity risk management program. The Audit Committee of our Board of Directors is responsible for overseeing management's processes for identifying and mitigating risks that affect our operations, including cybersecurity risks. Procedures for assessing, identifying and managing cybersecurity-related risks are incorporated into our overall risk management framework. Senior leadership regularly briefs the full Board of Directors on our cybersecurity and information security posture and the Audit Committee is apprised of cybersecurity incidents deemed to pose a critical risk to our information technology ("IT") assets or business. We rely upon in-house and third- party cybersecurity vendors to monitor our IT systems and assets and have a governance structure and processes to assess, identify, manage, and report cybersecurity risks.


text: We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader cybersecurity ecosystem.


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented policies designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. While we have taken measures designed to protect the security of the confidential and personal information under our control, we cannot provide absolute assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

companyName: Innovative Eyewear Inc

ticker: LUCY


text: Our cybersecurity program is managed by our executive management team, including our Chief Executive Officer and Chief Technology Officer, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with and received analysis reports from a cybersecurity advisor, and generally rely upon outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity risks.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Company intends to provide the Board of Directors with periodic updates on cybersecurity and information technology matters and related risk exposures from management.


text: All customer and app user information is stored directly within Shopify, Amazon Seller, and Amazon Web Services platforms, which provide market-leading data security for their centralized servers. On occasion, limited amounts of customer information such as names and emails are exported from these systems solely for the purposes of accounting and filings, and is never shared outside of the Company and its contracted accounting consultants, which are under confidentiality agreements. Highly sensitive customer payment information is generally never revealed to the Company in any capacity and is hidden by payment processors for security purposes, with the sole exception being some wholesale accounts who provide written or digital copies of credit card information for payment processing on agreed upon terms. Such information is secured on locked Company computers and never distributed.


text: We are a blank check company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Roth CH Acquisition Co.

ticker: USCTF


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: Yotta Acquisition Corp

ticker: YOTA


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. As of the date of this report, we have not encountered any cybersecurity incidents since our IPO.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, as noted in Item 1A. Risk Factors of this Annual Report. Any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Annual Report.

companyName: Voyager Acquisition Corp./Cayman Islands

ticker: VACH


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Mountain Crest Acquisition Corp. V

ticker: MCAG


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, tests on our systems, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including an information technology consultant, to enhance our cybersecurity oversight.

companyName: Vivakor, Inc.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our informational technology consultant leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our informational technology consultant has over 34 years of experience working with companies in the information technology field.


text: We are working with our information technology consultant to help improve our overall cybersecurity and plan to take any necessary steps to protect our information assets and operations from internal and external cyber threats in the event any such steps are recommended.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: We recognize that cybersecurity threats represent a significant risk to our business operations, reputation, and financial performance. To manage these risks, we maintain a comprehensive cybersecurity risk management program designed to identify, assess, mitigate, and respond to potential cybersecurity incidents.

companyName: Frequency Holdings, Inc

ticker: FRQN


text: Our cybersecurity program is integrated into our overall risk management framework and is aligned with industry standards and best practices. It includes regular risk assessments, vulnerability scans, penetration testing, and employee training programs. We use a layered approach to cybersecurity, leveraging firewalls, encryption, multi-factor authentication, and endpoint protection technologies to safeguard our systems and data.


text: We have established an incident response plan that outlines the procedures for detecting, responding to, and recovering from cybersecurity events. This plan is tested periodically through tabletop exercises and simulations to ensure readiness. In the event of a material cybersecurity incident, we are prepared to notify stakeholders and comply with all applicable regulatory requirements.


text: Oversight of cybersecurity risk is provided by our Board of Directors, which receives regular updates from management regarding cybersecurity matters. Management responsibility for cybersecurity is assigned to our Vice President of Services, who reports to senior leadership and the Board on a regular basis.


text: We have not experienced any material cybersecurity incidents to date. However, given the evolving nature of cybersecurity threats, we continue to invest in our cybersecurity capabilities and monitor the landscape to enhance our resilience against potential threats.


text: We are committed to safeguarding our information systems and data from potential cyber threats. Our cybersecurity measures include comprehensive policies, continuous monitoring, regular security assessments, and employee training programs to mitigate risks and enhance our defenses against cyber incidents. We have not experienced any material cybersecurity breaches to date.

companyName: KB Global Holdings Ltd


text: We have a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: AMERIGUARD SECURITY SERVICES, INC.

ticker: AGSS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors, in considering cybersecurity risk as part of its risk oversight function, oversees management's implementation of our cybersecurity risk management program. Our board of directors receives reports from management on our cybersecurity risks. In addition, management updates our board of directors, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Company's risk management program includes governance through the cybersecurity committee, consisting of senior executive management team along with legal and other key holders. Our Enterprise Risk Management lead is tasked with integrating any cybersecurity risk considerations into overall risk management strategy. Risk management includes regular risk assessments to identify internal and external risks and to evaluate the magnitude of harm that could arise out of such risks. Further, risk management may utilize third party service providers where complementary and supplementary to the Company's overall business strategy. Lastly, risk management includes training and education over the continuously evolving landscape of cybersecurity threats. We engage external parties, including consultants, independent privacy assessors, computer security firms, training service providers and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consult with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we maintain cyber insurance coverage.

companyName: Aeries Technology, Inc.


text: Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the ISO 27001, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), and other relevant standards.


text: effects of cybersecurity threats cybersecurity risks have the potential to affect the business, financial condition, and results of operations, we do not believe that risks from attacks, including results from any previous cybersecurity incidents or threats, have materially affected or likely to materially affect our strategy, operations or financial condition. However, no matter how well controls or designed or how well cybersecurity risk management procedures are implemented, there can be no full assurance given that risk remains of an incident that could cause material harm to the business. See " Our business relies heavily on owned and third-party technology and computer systems, which subjects us to various uncertainties " in the section entitled " Risk Factors ".


text: board of directors addresses our cybersecurity risk management as part of its general oversight function. As part of the Board's oversight, the Board will receive a report at least annually from our cybersecurity committee, covering updates on our cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape.


text: cybersecurity committee plays an active role by meeting periodically to review the status of the Company's cyber security program and roadmap for new cybersecurity risk management initiatives. The committee oversees cybersecurity risk management by evaluating whether management has robust cybersecurity policies and procedures, regularly assessing and monitoring cybersecurity risks, and receiving regular reports on the Company's cybersecurity posture. The cybersecurity committee holds monthly review meetings, to discuss the status of the Company's cybersecurity posture, plans and projects underway, and to discuss any changes in existing policies and procedures.


text: cybersecurity risk management processes are devised, implemented and assessed quarterly by our Cybersecurity lead, Enterprise Risk Management lead and Head of IT Strategy and Solutions. Our leads have extensive experience in cybersecurity and information technology, and based on their careers, have a deep understanding of our information technology and business needs. Our leads report to the cybersecurity committee monthly regarding emerging risks and the overall cybersecurity environment and immediately when a cybersecurity incident occurs. Our IT heads and Cybersecurity lead closely monitor cybersecurity risks, including our practices and procedures against the cybersecurity environment, including the operation of our incident response plan. Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We strongly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program.


text: This includes receiving quarterly exercises, cyber-event simulations, training programs and incorporating our Technology Acceptable Use Policy into onboarding and training materials.


text: We primarily rely on commercially available, third-party software and cloud-based service providers to support our business operations. These third-party providers generally maintain their own security features, such as access controls and data protection measures, and we rely on such features to safeguard our limited information systems.

companyName: Bodhi Tree Biotechnology Inc


text: Risk Management and Strategy Under the direction of AEI Capital Ltd., the Company has strategically repositioned itself and established a wholly-owned subsidiary, CapForce, which has launched a new business offering listing sponsorship and consultancy services to international companies seeking to list their securities on securities exchanges. Additionally, CapForce contemplates entering the financial technology industry with a focus on developing and supporting advanced digital investment banking activities, cross-border securities trading, advanced computational model-enabled investment banking advisory, asset management services, and FinTech-enabled capital table management. As part of this plan, risk management processes have been implemented to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection/onboarding process and a review of SOC 1 reports on an annual basis and other relevant security attestations, where applicable.

companyName: CapForce Inc.


text: In addition, CapForce will be maintaining policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. CapForce partners with industry recognized IT providers, leveraging third-party technology and expertise. These third-party service providers are a key part of CapForce's current cybersecurity risk management and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols and critical data backups. Our outsourced information technology consultants conduct proactive patching and monitoring of all of our existing systems and have implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition. In addition, we carry insurance with coverage for cyber events that we believe is suitable for a company of our size, stage of growth and financial condition.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors and Audit Committee has responsibility for the oversight of risk management, including risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology, including cybersecurity risks. Members of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, emerging threat landscape and new cyber risks, and provide updates on our processes to prevent, detect, and mitigate cybersecurity incidents.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and we work to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats, and have not experienced any cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition.


text: For additional information concerning risks related to cybersecurity, see Item 1A. Risk Factors: Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Protopia Global Holdings Inc.


text: Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.


text: The Company has designed this Cybersecurity and Information Technology Incident Response Plan based in part on the National Institute of Standards and Technology Cybersecurity Framework ("NIST"). Use of the framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the NIST is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's Cybersecurity and Information Technology Response Plan is led by our Chief Operations Officer, ("COO") who is responsible for the oversight and implementation of such plan. Additionally, the COO and the Information Security Manager meet with the Information Technology Steering Committee ("IT Steering Committee") on a monthly basis or more frequently as necessary to discuss, among other things, cybersecurity matters.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: The Cybersecurity and Information Technology Incident Response Plan is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk management, including legal, compliance, strategic, operational, and financial risk. In the event of a material or potentially material cybersecurity event, senior members of management, which includes the Chief Financial Officer, are promptly informed of the event and status update, response, and disclosure efforts following the terms of a documented incident response plan. Key elements of the Cybersecurity and Information Technology Incident Response Plan include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader information technology ("IT") environment; • an incident response team principally responsible for managing cybersecurity risk assessment processes, security controls, and responses to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity and IT incident response plan that includes procedures for responding to cybersecurity incidents; • utilization of independent third parties to perform penetration testing of the Company's environment; and • utilization of a third party to monitor our environment continuously.


text: The Company has experienced cybersecurity incidents in the past, but none of these incidents, individually or in the aggregate, have had a material adverse effect on our business, financial condition or results of operations. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Our Operations and Technology," which is incorporated by reference into this Item 1C.


text: Management's Role The Company's management has created an Incident Response Team ("IRT"), that consists of the Chief Operations Officer, a network manager, an application delivery manager, an information security manager, the IT Steering Committee, the regulatory risk management director and an internal auditor. Our COO holds multiple cybersecurity industry-recognized certifications and has gained extensive cybersecurity knowledge and skills through over 7 years of work experience on the IT security team at the Company. Our Information Security Manager, who also holds multiple cybersecurity industry-recognized certifications and is a member of the IT Steering Committee, has 20 years of experience working in IT and cybersecurity in various roles and industries throughout his career. Additionally, leaders in the Company's IT function receive periodic training and education on cybersecurity related topics. The IRT is governed by policies and procedures and their proactive responsibilities include implementing awareness programs for the overall cybersecurity risk management plan and for the supervision of vulnerability and penetration testing.


text: The Company's IRT serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target associates, customers or the Company's internal information systems and incidents originating from third parties. The IRT evaluates each incident in terms of its impact on the Company's operations, ability to conduct business with customers, reputational risk to the Company, reduce legal risk and the speed and degree to which the incident has been contained. The IRT is also responsible for assessing the nature and scope of the incident, and engaging third-party service providers where appropriate to support the Company through the resolution of the incident. The COO escalates incidents to the Company's IT Steering Committee, who is responsible for cybersecurity risk oversight, and also reports to the Board on a monthly basis.


text: Our information security team and members of IT also monitor the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, and external consultants we may engage, and reports produced by security tools we have deployed in our IT environment.


text: Board of Director's Role The Company's Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data, including with respect to its associates and customers. The Board is responsible for the consideration and oversight of risk facing the Company and is also responsible for ensuring that material risks are identified and managed appropriately, including cybersecurity risks. The COO gives a monthly report to the Company's IT Steering Committee and Board on various information security issues. The Company has created and designated a separate committee of its Board as the Audit Committee consisting of four independent directors. The Audit Committee meets quarterly and reviews the Company's major financial risk exposures, including cybersecurity risks, and reviews the steps management is taking to monitor and control such exposures, including results of internal and external audits.


text: The Company has designed this Cybersecurity program based in part on the National Institute of Standards and Technology Cybersecurity Framework ("NIST"). Use of the framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the NIST is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's Cybersecurity and Information Technology programs are led by our Chief Operations Officer, ("COO") and Information Security Manger. The COO is responsible for the oversight and implementation of both programs. Additionally, the COO and the Information Security Manager meet with the Information Technology Steering Committee ("IT Steering Committee") on a monthly basis or more frequently as necessary to discuss, among other things, cybersecurity matters.


text: The Cybersecurity and Information Technology programs are aligned to the Company's business strategy. They share common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk management, including legal, compliance, strategic, operational, and financial risk. In the event of a material or potentially material cybersecurity event, senior members of management, which includes the Chief Financial Officer, are promptly informed of the event and status update, response, and disclosure efforts following the terms of a documented incident response plan. Key elements of the Cybersecurity and Information Technology programs include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader information technology ("IT") environment; • an incident response team principally responsible for managing cybersecurity risk assessment processes, security controls, and responses to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity and IT incident response plan that includes procedures for responding to cybersecurity incidents; • utilization of independent third parties to perform penetration testing of the Company's environment; and • utilization of a third party to monitor elements of our Cybersecurity and IT environment continuously.


text: During the years ended December 31, 2024 and December 31, 2023, the Company had no cybersecurity incidents that had a material adverse effects on its business, financial condition or results of operations. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Our Operations and Technology," which is incorporated by reference into this Item 1C.


text: Our information security team and members of IT monitor the effectiveness of preventative measures, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, external consultants, and reports produced by security tools we have deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy We have developed a comprehensive cybersecurity program, modeled after the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), that forms a critical component of our overall risk management and business strategy and provides for a methodological approach to identifying, assessing and managing material risks from cybersecurity threats. Our risk assessment protocol considers both probability of occurrence and potential impact to our business and is predicated on the pillars of risk identification, analysis and mitigation. Execution of our cybersecurity program is coordinated by our management, dedicated cybersecurity employees and third-party providers. While no particular cybersecurity risk or incident has unilaterally influenced our strategy, we allocate a portion of our operational and capital budgets towards sustaining and improving our cybersecurity defense posture, in addition to maintaining tailored insurance coverage. We value the importance of safeguarding digital assets, ensuring trust, and operational continuity amidst evolving threats. By prioritizing cybersecurity, we endeavor to protect our interests and uphold our commitment to our stakeholders' security and privacy.

companyName: TaskUs, Inc.

ticker: TASK


text: To evaluate the adequacy of our cybersecurity program, we apply various assessment techniques, such as continuous asset audit, vulnerability management, external attack surface management, source code review, a bug bounty program, threat hunting, red-team exercises, and direct engagement with functional leaders. We routinely examine our cybersecurity defenses through automated and manual vulnerability scanning to identify and correct critical vulnerabilities. In addition, we conduct regular testing to evaluate our security posture and the adequacy of our policy as a whole. We compare our cybersecurity program against industry standards and established frameworks, such as the NIST and Center for Internet Security. Further, we engage in cyber incident simulation exercises executed by senior management and IT/Information Security personnel, involving hypothetical cybersecurity incidents to test our cyber incident response processes. In addition to the foregoing internal review of our cybersecurity program, we periodically engage independent third parties to assess the risks associated with our information technology resources and information assets. Among other things, these independent parties analyze the effectiveness of controls over information technology resources and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes for qualifications under recognized industry standards and for annual certification under Payment Card Industry Data Security Standard (PCI DSS), HITRUST, SOC 2 Type II, and ISO 27001. We memorialize our findings and review the results of these assessments with management and, where appropriate, our board of directors. Relevant modifications are incorporated into our cybersecurity framework to ensure that our systems functionally align with our cybersecurity strategies.


text: Furthermore, we engage third-party vendors to support our cybersecurity program. Prior to onboarding, we review the cybersecurity risk profile of third party vendors to ensure that they employ appropriate safeguards to comply with our internal standards and current industry regulations. We classify IT service providers according to their risk and independently audit their security controls on a recurring basis based on the types of services provided and the extent and type of data accessed or processed by a third-party vendor. Furthermore, in certain instances, we include contractual provisions in our agreements with such vendors to implement best practices with respect to data and cybersecurity, as well as to provide us with rights to assess, monitor, audit and test such vendors' cybersecurity programs and practices and to mandate notice requirements in the event of a breach. We also closely monitor and manage third-party access to our internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A. "Risk Factors – Unauthorized or improper disclosure of personal or other sensitive information, or security breaches and incidents, whether inadvertent or purposeful, including as the result of a cyber-attack, could result in liability and harm our reputation, each of which could adversely affect our business, financial condition, results of operations and prospects" in this Annual Report.


text: Cybersecurity Governance Our board of directors and management closely coordinate to execute on our cybersecurity strategy. Our board of directors oversees cybersecurity risk management as part of its oversight of our risk management framework, while the Audit Committee has primary responsibility for management of the risks facing our Company and oversight of the measures initiated by management to monitor and control such risks and reports to the board of directors. Our management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, and compliance. Our Division Vice President for Information Security (DVP, Information Security) reports to our Chief Information Officer (CIO) and has primary responsibility for the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security Management System. The CIO and DVP, Information Security meet regularly with the Audit Committee to review the company's management of information security risks, and the Audit Committee evaluates the adequacy of the Company's IT security program, compliance and controls with our CIO. Additionally, our Enterprise Risk Management Committee, which is composed of certain of our senior management, legal and operations teammates, provides senior management with sponsorship and guidance to ensure that overall risk management objectives are achieved and regularly reports to the board of directors on matters within its purview.


text: Our current DVP, Information Security has led the information security program at TaskUs for eight years, and has over a decade of prior experience in cybersecurity operations, risk assurance and internal audit. Additionally, he holds an MBA degree and multiple professional certifications including CISSP (certified information systems security professional), CISA (certified information systems auditor), CIA (certified internal auditor), CCSP (certified cloud security professional) and CRMA (certification in risk management assurance). The DVP, Information Security also leads our Information Security Council, which is composed of IT functional leads and is responsible for the quarterly review of cybersecurity risks and operations of the information security management system.


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. The Company engages a third-party to perform 24/7 monitoring for threats and unauthorized access to our information security network.

companyName: N-able, Inc.

ticker: NABL


text: We have also developed an incident response plan, designed to identify suspected or confirmed information security or cybersecurity events based on the expected risk an event presents, and expediently move such information through the appropriate personnel and channels. The plan details the sequence of steps and relevant personnel, roles, communication procedures, and incident response process flows to be used in the event of an applicable incident. Our Disclosure Committee, which is composed of certain of our senior management, legal and operations teammates, plays an integral role in this process, by supervising external reporting of cybersecurity incidents. Among other items, our procedures require calling an ad hoc committee meeting within 24 hours of incident identification for incident materiality assessment and determination.


text: To evaluate the adequacy of our cybersecurity program, we apply various assessment techniques, such as continuous asset audit, vulnerability management, external attack surface management, source code review, a bug bounty program, threat hunting, red-team exercises, and direct engagement with functional leaders. We routinely examine our cybersecurity defenses through automated and manual vulnerability scanning to identify and correct critical vulnerabilities. In addition, we conduct regular testing to evaluate our security posture and the adequacy of our policy as a whole. We compare our cybersecurity program against industry standards and established frameworks, such as the NIST and Center for Internet Security. Further, we engage in cyber incident simulation exercises executed by senior management and IT/Information Security personnel, involving hypothetical cybersecurity incidents to test our cyber incident response processes. In addition to the foregoing internal review of our cybersecurity program, we periodically engage independent third parties to assess the risks associated with our information technology resources and information assets. Among other things, these independent parties analyze the effectiveness of controls over information technology resources and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes for qualifications under recognized industry standards and for annual certification under Payment Card Industry Data Security Standard (PCI DSS), HITRUST, SOC 2 Type II, and ISO 27001. We memorialize our findings and review the results of these assessments with management and, where appropriate, our board of directors. Relevant modifications are incorporated into our cybersecurity framework to ensure that our systems functionally align with our cybersecurity strategies. Additionally, as the threat environment evolves, we have continued to refine our cybersecurity program in response to prior cyber incidents that have specifically impacted us, and that have more expansively impacted other companies; for example, we have recently instituted an incentive program for reporting of fraud threats and modified our employee training programs.


text: Our current DVP, Information Security has led the information security program at TaskUs for nine years, and has over a decade of prior experience in cybersecurity operations, risk assurance and internal audit. Additionally, he holds an MBA degree and multiple professional certifications including CISSP (certified information systems security professional), CISA (certified information systems auditor), CIA (certified internal auditor), CCSP (certified cloud security professional) and CRMA (certification in risk management assurance). The DVP, Information Security also leads our Information Security Council, which is composed of IT functional leads and is responsible for the quarterly review of cybersecurity risks and operations of the information security management system.


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks Since the completion of the Business Combination on February 14, 2024, management has been working to create a defined cybersecurity risk management program, through the addition of enhanced applications to identify and mitigate risks. During 2024 the Company engaged and managed an experienced third party vendor, specializing in cybersecurity, to conduct a Company wide cybersecurity risk assessment. The assessment included a multi-phase approach consisting of open-source intelligence gathering, network system penetration testing of the Company's internal, external, and wireless networks, and targeted social engineering through strategic phishing, vishing, and smishing campaigns. Action items and preventative recommendations were identified by management and are being incorporated into the Company's information security incident response plan, which is designed to follow the National Institute of Standards and Technology Cybersecurity Framework 2.0 standards and practices for identifying and mitigating cybersecurity incidents. Management will complete implementation of the action items during 2025, which we intend to test periodically for effectiveness.

companyName: Sable Offshore Corp.

ticker: SOC


text: No Previous Material Cybersecurity Threats As of the date of this report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences for the Company. While we intend to devote resources to our security measures to protect our systems and information during 2025, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Board of Directors' Oversight of Cybersecurity Risks The audit committee of our Board is responsible for the oversight of risks from cybersecurity threats. As part of its oversight, our audit committee and certain members of the Company's management will meet quarterly to discuss ongoing initiatives and to facilitate coordination between Company stakeholders. Annually, our Vice President of Information Technology will review the Company's cybersecurity risk management program with our audit committee and Board.


text: Management's Role in Assessing and Managing Cybersecurity Risks Our Vice President of Information Technology is primarily responsible for assessing and managing the Company's material cybersecurity risks, monitoring the effectiveness of our cybersecurity detection and response processes and providing updates on cybersecurity to our executive team. Our Vice President of Information Technology has more than 25 years of experience working in the field of information technology, including significant experience directing enterprise-level cybersecurity programs.


text: In the ordinary course of our business, we receive, process, retain, transmit and store proprietary information and sensitive or confidential data, including certain public and nonpublic personal information concerning employees and borrowers. In addition, we enter into relationships with third-party vendors to assist with various aspects of our business, some of which require the exchange of personal employee or borrower information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems, including those pertaining to third-party service providers, that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by dedicated information security teams, including technology risk, cybersecurity operations, cybersecurity engineering, and identity and access management, led by our Chief Information Security Officer ("CISO"). These teams collectively manage and monitor mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, access, or other security incidents or vulnerabilities affecting our data, digital assets and systems in furtherance of maintaining a secure information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct regular employee training on cyber and information security topics, phishing and simulations. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment. We also utilize a third party for cybersecurity incident monitoring and response.

companyName: loanDepot, Inc.

ticker: LDI


text: Our CISO, who reports to the Chief Information Officer and has over twenty years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. The CISO receives regular reports prepared by experienced information security officers on cybersecurity threats, based on data from the Information Security Department and, in conjunction with management, regularly reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks. Certain risk topics, such as cybersecurity and compliance, are discussed at Enterprise Risk Management Committee (consisting of executive management) meetings, and are included in reports to the Board and Audit Committee.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management program. While we have identified risks from cybersecurity threats, such risks have not materially affected us, including our business strategy, results of operations or financial condition, with the exception of the Cybersecurity Incident, as disclosed in a Current Report filed by the Company on Form 8-K on January 8, 2024, as amended on January 22, 2024 and February 27, 2024, which the Company believes will have a material impact on the Company's first quarter 2024 results. As previously disclosed, among other things, the Company expects to record in the first quarter of 2024 approximately $12 to $17 million of expenses related to the Cybersecurity Incident, net of expected insurance recovery. In addition, the Company has been named as a defendant in several lawsuits related to this Cybersecurity Incident, which are seeking various remedies, including monetary and injunctive relief. While we cannot presently quantify the full scope of expenses and other related impacts associated with this Cybersecurity Incident, including costs associated with any related current or future litigation or regulatory inquiries or investigations, the Company currently does not expect that the cybersecurity incident will have a material effect on its overall financial condition or on its ongoing results of operations. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Cyberattacks, information or security breaches and technology disruptions or failures, including failure of internal operational or security systems or infrastructure, or other cybersecurity incidents of ours or of our third-party vendors, could damage our business operations and increase our costs, which could adversely affect our business, financial condition and results of operations."


text: The Board of Directors, as a whole and at the committee level, oversees our enterprise risk management program, the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives quarterly or as needed updates on cybersecurity and information technology matters and related risk exposures from our CISO and Chief Information Officer. The Board also receives regular updates from our CISO and Chief Information Officer on cybersecurity risks. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee and the Board of Directors.


text: In the ordinary course of our business, we receive, process, retain, transmit and store proprietary information and sensitive or confidential data, including certain public and nonpublic personal information concerning employees, borrowers and other customers and potential customers. In addition, we enter into relationships with third-party vendors to assist with various aspects of our business, some of which require the exchange of personal employee or customer information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems, including those pertaining to third-party service providers, that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by dedicated information security teams, including technology risk, cybersecurity operations, cybersecurity engineering, and identity and access management, led by our Chief Information Security Officer ("CISO"). These teams collectively manage and monitor mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, access, or other security incidents or vulnerabilities affecting our data, digital assets and systems in furtherance of maintaining a secure information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, and other contractors and suppliers. We also conduct regular employee training on cyber and information security topics, phishing and simulations. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment. We also utilize a third party for cybersecurity incident monitoring and response.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management program. While we have identified risks from cybersecurity threats, such risks have not materially affected us, including our business strategy, results of operations or financial condition, with the exception of the Cybersecurity Incident, as disclosed in a Current Report filed by the Company on Form 8-K on January 8, 2024, as amended on January 22, 2024 and February 27, 2024, and in subsequent filings with the SEC. We recognized $24.6 million of expenses related to the Cybersecurity Incident, net of insurance recoveries during fiscal 2024. In addition, we were named, and may still be named, as a defendant in lawsuits related to this Cybersecurity Incident, which are seeking various remedies, including monetary and injunctive relief. Further, we have engaged with and continue to engage with regulators related to the Cybersecurity Incident. While we cannot presently quantify the full scope of expenses and other related impacts associated with this Cybersecurity Incident, including costs associated with any related current or future litigation or regulatory inquiries or investigations, we currently do not expect that the Cybersecurity Incident will have a material effect on our overall financial condition or on our ongoing results of operations beyond those amounts already accrued. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Cyberattacks, information or security breaches and technology disruptions or failures, including failure of internal operational or security systems or infrastructure, or other cybersecurity incidents of ours or of our third-party vendors, could damage our business operations and increase our costs."


text: The Audit Committee receives periodic reports from management on our cybersecurity risks, and our IT team directly reports to the Audit Committee on a periodic basis. In addition, management is obligated to update the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: The Board of Directors, as a whole and at the committee level, oversees our enterprise risk management program, the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regularly scheduled and as needed updates on cybersecurity and information technology matters and related risk exposures from our CISO and Chief Information Officer. The Board also receives regular updates from our CISO and Chief Information Officer on cybersecurity risks. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee and the Board of Directors.


text: Risk Management and Strategy Our cybersecurity strategy focuses on striking a balance between data barriers and access, and promoting vigilance among our employees, contractors, and business partners. We monitor and implement procedures, policies, and activities designed to manage our data and to maintain a high level of privacy and security within our systems. In 2023, we undertook an in-depth enterprise risk analysis and designed a program to address the most significant risks affecting our business. Our newly-developed enterprise risk program integrates cybersecurity.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: Our cybersecurity processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have an information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other standards and regulations. Our program includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls.


text: Through our cybersecurity program, we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats.