text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Bancorp 34, Inc.

ticker: BCTF

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: monitoring and mitigating cybersecurity threats and risks with a defense structure to provide a third-party cybersecurity oversight program to effectively discover, analyze and understand oversight of our information security program by senior management, our board-level Information Security Committee, and our Board of Directors;

stage1Category: Board Governance

stage1Method: unanimous


text: establishing and maintaining a comprehensive program to oversee and manager external connections and third-party relationships with access to the institution's technology assets and information; and an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of two of our employees. We notified the affected customers of the incident in early September 2023, and have taken steps to mitigate our and our customers' exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the cybersecurity incident.

stage1Category: Incident Disclosure


text: cybersecurity risk management strategy uses a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs, technology and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our critical third-party service providers.


text: use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense of an incident we maintain cyber insurance.

stage1Category: Third-Party Risk


text: to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.

stage1Category: None/Other


text: Through established governance structures, including our problem and incident management process and incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Information Security Committee, or to the full Board, as appropriate.


text: Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately.


text: Our Board of Directors oversees our cybersecurity, risk assessment, vendor management and disaster recovery and business continuity risk management framework. The Board of Directors reviews and approves our cybersecurity, disaster recovery and business continuity risk management framework on an annual basis.


text: Board regularly receive reports on such matters from our Information Security committee. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: The Company recognizes the importance of cybersecurity and the potential risks associated with cyber incidents. As a small entity with simple operations managed solely by our Chief Executive Officer (CEO), we have not implemented formal cybersecurity policies or procedures. However, we take reasonable steps to protect our electronic data and ensure the security of our operations.

companyName: PRESTIGE CAPITAL CORP


text: Board has delegated the primary review of our cybersecurity, disaster recovery, risk assessment, vendor management, and business continuity risk management framework and related policies and procedures to the Information Security Committee, which consists of senior management members and one Board member. The committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our cybersecurity, disaster recovery, vendor management and business continuity risk management framework. The committee actively discusses major risk exposures, establishes risk management principles, and determines our risk appetite, and regularly reports on their activities, and makes recommendations to, the full Board. The Information Security Committee receives regular summary analysis reports of cybersecurity risks, threats, and incidents at their meetings. In addition, the committee is engaged, as needed, in accordance with our Incident Response Plan and Business Continuity Plan.


text: Role of Management management is responsible for establishing, implementing, maintaining, and testing our policies and procedures related to cybersecurity, disaster recovery and business continuity. Reports on these matters are provided to the Information Security Committee. The committee reports its activities to the full Board of Directors. Our cybersecurity risk management program is built on lines of defense designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our VP of IT Operations is responsible for coordinating the implementation of cybersecurity framework and reports directly to our Chief Financial Officer.

stage1Category: Management Role


text: framework, implemented in conjunction with third party managed IT providers, manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, training on information security awareness is provided to employees. Training materials and topics include online training classes, mock phishing attacks, and information security awareness emails from the VP of IT Operations. O ur cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, escalate and recover from cyber threats.


text: Information Security Committee governs our technology and operational risk tolerances, including cybersecurity and third- and fourth-party provider risks. The management members who serve as part of the committee include the VP of IT Operations (chair), Chief Operations Officer, Chief Financial Officer, and Chief Compliance Officer. The VP of IT Operations has relevant technical experience and certifications with over 20 years of respective experience. The remaining committee members each have more than 15 years of relevant banking experience.


text: The Committee is responsible for escalating key risks members of Executive Management not serving on the committee as well the Board of Directors. audit over cybersecurity related activities is completed by an independent third party.


text: We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. To help manage these risks, we engage and rely on external experts and an information technology managed services provider. Our managed services provider's information security analysts and IT security specialists offer us advice on technology, infrastructure, management, and productivity in relation to our information technology capabilities.

companyName: SWK Holdings Corp

ticker: SWKH


text: To address risks from cybersecurity threats, we have implemented and maintain cybersecurity policies and procedures, including an incident response plan, and our managed services provider implements a number of cybersecurity technologies and controls, including but not limited to, vulnerability scans and patch management tools. Our current approach to managing cybersecurity risks is informed by periodic risk assessments conducted by our managed services provider that incorporates elements of a recognized industry framework and evaluates our cyber risk management controls. We have implemented a process for senior management to review assessments performed and determine the appropriate treatment of identified risks.


text: We have also developed a cybersecurity risk management process for our third-party vendors. This process aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity risk profile. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information about the cybersecurity risks we face, see Item 1A "Risk Factors."


text: We engage a managed services provider as discussed above, which includes services to assist us with the identification, monitoring, and management of cybersecurity risks. Our managed services provider reports periodically to our management team, including our Chief Executive Officer ("CEO"). The CEO briefs the Board on information regarding cybersecurity matters at least quarterly.


text: Given the size of our company and the nature of our operations, we believe the risk of significant cybersecurity incidents is minimal. Our CEO is responsible for overseeing all aspects of our business, including the management of cybersecurity risks. We utilize standard commercial software for business operations, which includes basic security features such as password protection and data encryption.


text: cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data; actively monitoring and mitigating cybersecurity threats and risks with a defense structure to provide oversight, governance, challenge, and testing;


text: using a third-party cybersecurity oversight program maintaining oversight of our information security program by senior management, our board-level Information Security Committee, and our Board of Directors;


text: establishing and maintaining a comprehensive program to oversee and manager external connections and third-party relationships with access to the institution's technology assets maintaining an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of two of our employees. We notified the affected customers of the incident in early September 2023 and have taken steps to mitigate our and our customers' exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the cybersecurity incident.


text: cybersecurity risk management strategy uses a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs, technology and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our critical third-party service providers.


text: We use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines.


text: We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information.


text: Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense of an incident we maintain cyber insurance.

stage1Category: Strategy Integration


text: to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our problem and incident management process and incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Information Security Committee, or to the full Board, as appropriate.


text: Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately.


text: Our Board of Directors oversees our cybersecurity, risk assessment, vendor management and disaster recovery and business continuity risk management framework. The Board of Directors reviews and approves our cybersecurity, disaster recovery and business continuity risk management framework on an annual basis.


text: Board regularly receive reports on such matters from our Information Security committee. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Board has delegated the primary review of our cybersecurity, disaster recovery, risk assessment, vendor management, and business continuity risk management framework and related policies and procedures to the Information Security Committee, which consists of senior management members and one Board member. The committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our cybersecurity, disaster recovery, vendor management and business continuity risk management framework.


text: The committee actively discusses major risk exposures, establishes risk management principles, and determines our risk appetite, and regularly reports on their activities, and makes recommendations to, the full Board. The Information Security Committee receives regular summary analysis reports of cybersecurity risks, threats, and incidents at their meetings. In addition, the committee is engaged, as needed, in accordance with our Incident Response Plan and Business Continuity Plan.


text: management is responsible for establishing, implementing, maintaining, and testing our policies and procedures related to cybersecurity, disaster recovery and business continuity. Reports on these matters are provided to the Information Security Committee. The committee reports its activities to the full Board of Directors. Our cybersecurity risk management program is built on lines of defense designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our VP of IT Operations is responsible for coordinating the implementation of cybersecurity framework and reports directly to our Chief Financial Officer.


text: framework, implemented in conjunction with third party managed IT providers, manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, training on information security awareness is provided to employees. Training materials and topics include online training classes, mock phishing attacks, and information security awareness emails from the VP of IT Operations. Our cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, escalate and recover from cyber threats.


text: Information Security Committee governs our technology and operational risk tolerances, including cybersecurity and third- and fourth-party provider risks. The management members who serve as part of the committee include the VP of IT Operations (chair), Chief Operations Officer, Chief Financial Officer, and Chief Compliance Officer. The VP of IT Operations has relevant technical experience and certifications with over 20 years of respective experience. The remaining committee members each have more than 15 years of relevant banking experience.


text: The Committee is responsible for escalating key risks members of Executive Management not serving on the committee as well the Board annual audit over cybersecurity related activities is completed by an independent third party.


text: Risk Management and Strategy We depend on information technology ("IT") and operational technology ("OT") for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, point-of-sale processing at our retail sites, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: We established a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the board of directors of our general partner. Our Chief Technology Officer & Digital Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. The Partnership follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: Our risk assessment process related to cybersecurity includes identifying threats and conducting vulnerability assessments, likelihood and impact assessments related to our own information and OT systems as well as our third-party service providers. The Partnership collaborates with third-party vendors to leverage managed security services, enhancing the Partnership's cybersecurity capabilities. The Partnership possesses monitoring capabilities for both its IT and OT infrastructure. To identify material cybersecurity risks, we use a combination of technical assessments, risk analysis, vulnerability scanning, incident and event monitoring, threat intelligence and third-party assessments along with ongoing monitoring and management.


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. The Partnership has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, The Partnership has increased the frequency and sophistication of the mandatory training and phishing campaign program for our employees. The Partnership also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. The Partnership is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the two drills conducted in 2023, we are dedicated to continuous improvement and proactive readiness in addressing potential challenges and ensuring the effective management of incidents.


text: The Partnership has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2023, 2022 and 2021. The Partnership continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.


text: Board of Directors Oversight The board of directors of our general partner and executive leadership team at the Partnership are committed to investing the attention and resources necessary to maintain the privacy, security and integrity of our information, systems and networks and enhance the Partnership's resiliency against cyber threats. To assist in these efforts, the board of directors of our general partner has assigned a number of cybersecurity related responsibilities to its standing committees while retaining overall responsibility for the oversight of Delek's cybersecurity activities.


text: Unresolved Staff Comments & Properties In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Partnership programs are discussed with the Board of Directors by the Chief Technology & Digital Officer Chief Information Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: In 2021 the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Partnership's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Partnership's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Partnership's digitalization, information and operational security policies help ensure strategic alignment of the Partnership's strategies with information security and risk management.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Digital Officer/Chief Information Officer reports to the President, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Digital Officer/Chief Information Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Digital Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Partnership. Senior leadership including our Chief Technology & Digital Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: We maintain and continually enhance a comprehensive, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the board of directors of our general partner. Our Chief Technology & Data Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. The Partnership follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, The Partnership upholds a robust mandatory security awareness program, including required training and phishing campaigns for our employees. The Partnership also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. The Partnership is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the drill conducted in 2024 and previous years, we remain committed to continuous improvement and proactive preparedness in addressing potential challenges and effectively managing incidents.


text: The Partnership has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2024, 2023 and 2022. The Partnership continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.


text: Unresolved Staff Comments, Cybersecurity Related Matters, Legal Proceedings and Mine Safety Disclosures In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Partnership programs are discussed with the Board of Directors by the Chief Technology & Data Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Data Officer reports to the President, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Data Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Data Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Partnership. Senior leadership including our Chief Technology & Data Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.

companyName: GLAUKOS Corp

ticker: GKOS


text: Like all businesses, the Company faces cybersecurity threats, as the Company is reliant upon information systems and the Internet to conduct its business activities. For example, in connection with payment card sales and other transactions, including bank cards, debit cards, credit cards and other merchant cards, the Company processes and transmits confidential banking and payment card information. Additionally, as part of its normal business activities, the Company collects and stores sensitive personal information related to the Company's employees, customers, suppliers and other parties. Businesses, including those in our industry, and third parties on which we rely are frequently confronted with a broad range of cybersecurity threats, from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Although the Company employs measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personally identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. Any such incidents could compromise the Company's networks, or those of our vendors, or disrupt the Company's or our vendors' critical systems, and the information stored there, such as personally identifiable information or funds, could be accessed, publicly disclosed, lost, corrupted or stolen. Third parties may have the technology and know-how to breach the security of this information, and the Company's security measures and those of the Company's banks, merchant card processing and other technology suppliers may not effectively prohibit others from obtaining improper access to this information. The techniques used by criminals to obtain unauthorized access to sensitive data change frequently and often are not recognized until launched against a target; accordingly, the Company may be unable to anticipate these techniques or implement adequate preventative measures.


text: The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, and litigation with third parties, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of the Company's enterprise risk management program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. The Company has established controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The Company has also established a process to validate the aforementioned controls are in place and the results are being reviewed as a part of the overall company risk assessment. The Company's Incident Response Plan (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures, and (ii) sets forth a process to (a) analyze any such threats detected within the Company's IT environment or within a third-party's IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.


text: The Company has cybersecurity insurance (subject to specified retentions or deductibles) related to a cybersecurity incident that addresses costs, losses, and expenses related to cybersecurity investigations, crisis management, notification processes and credit monitoring services, public relations, and legal advice. However, damages, fines and claims arising from such incidents may not be covered or may exceed the amount of any insurance available or may not be insurable.


text: As part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, extended detection and response systems, identity and access controls, strong password controls, multi-factor authentication, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, vulnerability scanning, and performing external penetration testing. The Company has a process to report material results of such testing and assessments to the Board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to oversee and conduct part of such testing, as well as perform external audits of security protocols and capabilities. The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective by identifying critical vendors (defined based on capabilities provided and investments required) and reviewing software patching, upgrades and associated changes required to reduce risk. The Company also conducts cybersecurity training for employees, including mandatory training programs for system users. The Company's training programs require employees to complete a knowledge check prior to completion of the program. Completion of the Company's training programs is monitored by management.


text: Many of the Company's IT systems operate with a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems could stop functioning for a period of time, which could put our users at risk. Accordingly, we are dependent on the operations of IT service providers. Our vendor management process, which includes due diligence steps prior to selecting third party service providers, is an important part of our risk mitigation strategy. In particular, we require ISO and other security compliance for all critical vendors by contract. Additionally, the Company monitors risks from cybersecurity threats associated with the user of third-party service providers and will audit critical vendors for compliance, as appropriate. Notwithstanding, if there is a catastrophic event, such as a natural disaster or other adverse weather condition, terrorist attack, security breach, or other extraordinary event, the Company, and our service providers, may be unable to operate business as usual, or at all, for the duration of the event and/or a time thereafter.


text: Considering the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives and requests management report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee and the full Board receive quarterly reports from the Chief Information Officer on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our Board has risk management experience, including members with experience in overseeing teams responsible for data security and cybersecurity and assessing technology-related risks and development of risk mitigation strategies.


text: In addition, the Company's information security/cybersecurity program is managed by the Director of Infrastructure and Security, who is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Infrastructure and Security and Chief Information Officer provide periodic reports to our Board and Audit Committee as well as our Chief Executive Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. The Incident Response Team, which includes the Chief Information Officer, Director of Infrastructure and Security, Chief Finance Officer and key operational leaders, is regularly engaged to discuss cybersecurity risks and to review the Company's preparations for any security events. The Incident Response Team will notify the Board of Directors of any critical events as defined in the Incident Response Plan. Additionally, the Chief Information Officer regularly engages the Board representative with cybersecurity experience to identify Board-level needs for education and communication.


text: The Chief Information Officer holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as a senior technology leader or Chief Information Officer of two public companies and two private equity-owned firms. The Chief Information Officer and Chief Financial Officer have prior experience supporting organizations that have experienced cybersecurity events and continue to learn more about the current trends and risks by partnering with third parties.


text: While the Company faces a number of cybersecurity risks in connection with its business, as of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Considering the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives and requests management report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks, including artificial intelligence. Both the Audit Committee and the full Board receive quarterly reports from the Chief Information Officer on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our Board has risk management experience, including members with experience in overseeing teams responsible for data security and cybersecurity and assessing technology-related risks and development of risk mitigation strategies.


text: As part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, extended detection and response systems, identity and access controls, strong password controls, multi-factor authentication, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity (including artificial intelligence-related) threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, vulnerability scanning, and performing external penetration testing. The Company has a process to report material results of such testing and assessments to the Board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to oversee and conduct part of such testing, as well as perform external audits of security protocols and capabilities. The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective by identifying critical vendors (defined based on capabilities provided and investments required) and reviewing software patching, upgrades and associated changes required to reduce risk. The Company also conducts cybersecurity training for employees, including mandatory training programs for system users. The Company's training programs require employees to complete a knowledge check prior to completion of the program. Completion of the Company's training programs is monitored by management.


text: In addition, the Company's information security/cybersecurity program is managed by the Director of Infrastructure and Security, who is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Infrastructure and Security and Chief Information Officer provide periodic reports to our Board and Audit Committee as well as our Chief Executive Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. The Incident Response Team, which includes the Chief Information Officer, Director of Infrastructure and Security, Chief Financial Officer and key operational leaders, is regularly engaged to discuss cybersecurity risks and to review the Company's preparations for any security events. The Incident Response Team will notify the Board of Directors of any critical events as defined in the Incident Response Plan. Additionally, the Chief Information Officer regularly engages the Board representative with cybersecurity experience to identify Board-level needs for education and communication.


text: The Chief Information Officer holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as a senior technology leader or Chief Information Officer of two public companies and two private equity-owned firms. The Chief Information Officer has prior experience supporting organizations that have experienced cybersecurity events and continue to learn more about the current trends and risks by partnering with third parties.


text: While the Company faces a number of cybersecurity risks in connection with its business, as of the date of this report, the Company is no t aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or its third-party service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under Item 1A. "Risk Factors" in this report.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Empire State Realty OP, L.P.

ticker: ESBA


text: We partner with third parties to implement and assess the effectiveness of our cybersecurity prevention and response systems and processes. We have a Managed Service Provider (MSP) and Managed Security Services Provider (MSSP) that provide 24 x 7 x 365 Network Operations Center and Security Operations Center (SOC) and works with our information technology (IT) team to employ a variety of monitoring technologies to detect and be alerted to potential cyber threats, as well as establish and implement procedures for the mitigation and remediation of any cybersecurity incidents. We conduct an annual penetration test, regular phishing tests, and annual cybersecurity training for our employees.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber threat. This plan is reviewed and updated at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from ESRT's Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and any failure to comply with related laws could negatively impact us." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: ESRT's Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of ESRT's Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer (CTO) is responsible for leading the assessment and management of cybersecurity risks, oversees teams across the Company supporting our cybersecurity policies and procedures around prevention, detection, mitigation and remediation of cybersecurity incidents, and reports at least quarterly to the Audit Committee on cybersecurity strategy and risks. Our CTO has over 25 years of experience in cybersecurity and information technology, is the Chair of the Real Estate Board of Cyber Committee, a Board Member of the Real Estate Cyber Consortium and is a Board Member of the Global Cyber Consortium.


text: face cybersecurity risks as a result of the variety of networks and systems we must defend against cybersecurity attacks; and the level of harm that could occur if we suffer impacts of a material cybersecurity incident. We are committed to robust oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended December 31, 2023, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, we have experienced two such material breaches in the past (see Form 10-K for the year ended 2023) and there can be no guarantee that we will not experience such incidents in the future. Such incidents could result in us incurring significant costs related to implementing threat protection measures, and the possibility of such incidents could result in additional costs in defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, cybersecurity threats are constantly evolving, increasing the difficulty of successfully defending against them or implementing adequate preventative measures. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable, we remain potentially vulnerable to known or unknown threats. In some instances, we may be unaware of a threat or incident or its magnitude and effects for some time. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.

companyName: BION ENVIRONMENTAL TECHNOLOGIES INC

ticker: BNET


text: industry best practices throughout our cybersecurity program to the extent practicable for a company of our size and resources. New leadership is committed to improving our cybersecurity strategy, with the goal of enhancing controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program will be aligned with applicable industry standards and maintained by a third-party technology firm. The third-party firm has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, annual and ongoing security awareness advice for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools.


text: IT/ cybersecurity firm reports to our Chief Executive Officer ("CEO"). The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CEO reports directly to the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Board of Directors will occur at least annually, or more frequently as determined to be necessary or advisable.


text: Risk Management and Strategy Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board and our Audit Committee are actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks and applicable established industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures;


text: training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures;


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity third-party risk management process for service providers, suppliers, and vendors.


text: Notwithstanding the measures we have put in place internally and through third party industry experts, on October 15, 2025, we learned that a threat actor had gained unauthorized access to portions of our information technology ("IT") environment and claimed to have unlawfully accessed certain Company information and data. We immediately activated our cyber incident response plan to contain the intrusion, assess and investigate the incident and implement remedial measures. We also immediately notified law enforcement, including the Federal Bureau of Investigation (FBI), and retained external cybersecurity experts to assist. Based on our investigation to date, we believe that the cybersecurity incident consisted of unauthorized access and deployment of encryption and monitoring software by a third party to a portion of our internal corporate IT systems.


text: The incident caused disruptions and limitation of access to portions of our business applications supporting aspects of our operations and corporate functions, which we voluntarily took offline as a precautionary measure. Based on the information reviewed to date, we believe the unauthorized activity has been contained and we were able to bring the impacted portions of our IT systems and individual computer devices back online and operate at full capacity within a week of detection of the unauthorized access.


text: However, it is believed that the threat actors unlawfully accessed certain computer systems and exfiltrated images of video meetings and computer screens that may contain sensitive information. The threat actors released a portion of this information publicly and that of some of our vendors and customers since we had not acceded to their demand for a monetary payment. However, we do not believe that the threat actor was able to infiltrate the computer systems of any of our customers or vendors. We have taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access and bolstering our cyber defensive capabilities.


text: We believe that there will be additional costs associated with these activities but that the disruption to our operations and the costs associated with our cybersecurity experts will largely be covered by adequate insurance. However, there can be no assurance that our insurance carriers will accept liability under these policies, in which event, we would be compelled to pay the expenses of our cyber experts directly, which would increase our costs and have a material adverse effect on our future financial performance.


text: As the investigation of the incident is ongoing, the full scope, nature and ultimate impact of the incident are not yet completely known. We have no current evidence that any personally identifiable information of any employees, customers, suppliers or vendors has been compromised, but our analysis and review of the potential compromised systems and data is continuing.


text: Board is engaged in the oversight of cybersecurity threat risk management. Additionally, the Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Financial Officer. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: cybersecurity programs. Our expertise in IT and cybersecurity generally has been gained from a combination of education, best practices and prior experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above. As evidenced by the cybersecurity incident described above, no combination of defensive measures are infallible. However, we are confident that we have established robust and reasonable measures and defenses consistent with industry standards and our Company's operations and use of internet-related systems. While this landscape is continually changing, we attempt to be knowledgeable and flexible with regard to the protection of our data and that of our partners.


text: The Company recognizes the importance of cybersecurity and the potential risks associated with cyber incidents. As a small entity with simple operations managed solely by our Chief Executive Officer (CEO), we have not implemented formal cybersecurity policies or procedures. However, we take reasonable steps to protect our electronic data and ensure the security of our operations.

companyName: C & C TOURS, INC.


text: Given the size of our company and the nature of our operations, we believe the risk of significant cybersecurity incidents is minimal. Our CEO is responsible for overseeing all aspects of our business, including the management of cybersecurity risks. We utilize standard commercial software for business operations, which includes basic security features such as password protection and data encryption.


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. We will continue to monitor our cybersecurity risk profile and take appropriate actions to safeguard our data and systems.


text: Should any material cybersecurity incidents occur, we will assess the situation and disclose the nature, scope, and potential impact of the incident in accordance with SEC regulations.


companyName: CANCER CAPITAL CORP


companyName: NOVA STAR INNOVATIONS INC


companyName: SKINOVATION PHARMACEUTICAL INC


text: store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Premier Air Charter Holdings Inc.

ticker: PREM


text: Cyber Risk Management and Strategy the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process.


text: third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We utilize well-known cloud-based technologies and service providers such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.


text: we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies. from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a)

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. The Company's Board of Directors as well as its Chief Technology Officer, Chief Information Security Officer, and Chief Financial Officer are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes, and practices for assessing, identifying, managing and mitigating material risks from cybersecurity threats.


text: rely on a multidisciplinary team, including our information security function, management, and third-party service providers to identify, assess, remediate and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, utilizing internal and external audits, and conducting threat and vulnerability assessments.


text: least annually, we review our security controls and address information security vulnerabilities, conduct security testing, and assess our external sources for their security risk (e.g., security incidents, data security, security controls, third parties, etc.). The results of the assessment are used to drive alignment and prioritization of initiatives to enhance our security posture, improve security processes, and to manage a broader enterprise-level risk program that is presented to the Board of Directors, the Audit Committee, and members of management.


text: Company maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats against our information systems and data. These include: incident detection and response management controls within our accounting and financial reporting functions security controls security management risk management program training.


text: the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. Refer to Item 1A for a discussion of cybersecurity risks.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee specifically assists the Board of Directors in its oversight of risks related to cybersecurity.


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: AMAZE HOLDINGS, INC.

ticker: AMZE


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Information Technology or IT department assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program.

companyName: Semler Scientific, Inc.


text: All employees receive cybersecurity training with job-specific topic considerations. Our IT team engages third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. The employees within our broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. Refer to the risk factor captioned " An information security incident, including a cybersecurity breach, could have a negative impact on our business or reputation" in Part I, Item 1A. "General Risk Factors" for additional description of cybersecurity risks and potential related impacts on our company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The audit committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short, intermediate, and long-term timeframe. Audit committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the chief financial officer on our enterprise risk profile on an annual basis. The audit committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our chief technology officer, or CTO, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current CTO has over 30 years of experience in information technology and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CTO provides periodic updates on our cybersecurity risk profile to management and the audit committee of our board of directors.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Information Technology or IT, department assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The audit committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short, intermediate, and long-term timeframe. Audit committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the chief technology officer or CTO on our enterprise risk profile on an annual basis. The audit committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our CTO is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current CTO has over 30 years of experience in information technology and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CTO provides periodic updates on our cybersecurity risk profile to management and the audit committee of our board of directors.


text: As a global leader in animal health, we are reliant on complex information systems and digital solutions that make us inherently vulnerable to malicious cyber intrusion and attack. In addition, we have been expanding our data and digital capabilities including in our diagnostics portfolio, and as a result, there could be an increased likelihood of a cyberattack or breach of security that could negatively impact us or our customers. Despite the presence of these risks, to date, the identified risks of cybersecurity threats (including as a result of any previous cybersecurity incidents) have not materially affected, and are not reasonably likely to materially affect, us or our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: Zoetis Inc.

ticker: ZTS


text: Cybersecurity Program As part of our risk management processes, we have an enterprise-wide cybersecurity program aligned to the NIST Cybersecurity Framework. Our program is a risk-based program designed to protect our information systems through multiple defenses and layers of security, commonly referred to as a "Defense in Depth" approach. Key elements of our program include:


text: Independent Third-Party Assessments We engage an independent third party to conduct assessments of our cybersecurity program approximately every 18 months. This independent third-party assessment includes an evaluation of our cybersecurity controls based on the NIST Cybersecurity Framework.


text: We have an information security training program that includes: monthly awareness articles, a phishing training program (with reports reviewed by the Executive Team), a Security Ambassador program for additional training and awareness for individuals in high risk roles, required and optional training modules in our Learning Management System, and quarterly security-focused podcasts.


text: Incident Response Procedure We have a 24/7 managed Security Operations Center (SOC) for escalation of any critical events, including cybersecurity incidents. In the event of an incident, we use an Incident Response procedure leveraging NIST Standard 800-61 standards that we have customized for Zoetis. Additionally, we have in place disaster recovery and business continuity practices designed to provide for continuous business operations for our customers in the event of a cybersecurity incident. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Third Party Onboarding We depend on third parties and applications on virtualized (cloud) infrastructure to operate and support our information systems and have a third-party risk management program and assessment process for onboarding third parties.


text: Management's Role in Risk Oversight Our information security team includes our Executive Vice President, Chief Digital & Technology Officer; our Vice President, Chief Information Officer; and our Head of Technology Risk, Compliance and Chief Information Security Officer. Our Executive Vice President, Chief Digital and Technology Officer has over 20 years of information technology experience. She was the Chief Information Officer for key business units at an S&P 500 healthcare company, and was that company's first Chief Information Security Officer, where she led the strategy and execution to secure products, devices, manufacturing systems and information across businesses. She holds a master's degree in computer science and a master's degree in business applications of information and technology. Our Vice President, Chief Information Officer has over 20 years of experience in technology and digital leadership roles at large public companies and holds a bachelor's degree in information systems. Our Head of Technology Risk, Compliance and Chief Information Security Officer has over 20 years of experience in information security, and holds a bachelor's degrees in computer science and biology.


text: We have established a cybersecurity governance program with clear roles for the executive management team as well as oversight by the Board of Directors and the Audit Committee. The Zoetis information security team provides regular cyber threat intelligence briefings to management and provides updates to our senior executives on the status of the Company's security measures and our efforts to identify and mitigate risks from cybersecurity threats. The Zoetis information security team also works closely with the Zoetis Legal team, including the Chief Privacy Officer, to further enhance incident response procedures. For example, we have a corporate crisis management plan in place to govern our response to corporate crises, which could include cyber incidents, and we conduct periodic simulated programs to ensure readiness. This plan also includes a standard framework for categorization of incidents based on risk level and severity, and requires escalation to Zoetis senior management and/or the Audit Committee of the Board of Directors if certain severity levels are met.


text: Role of the Board of Directors and Committees The Board of Directors maintains an active role in the oversight of material risks. The Board of Directors utilizes its various Committees to oversee certain key risks, and has delegated responsibility to the Audit Committee for oversight of the Company's enterprise risk management process and information security risk management program. Management, with oversight from the Zoetis Board of Directors, is responsible for the Company's assessment and management of exposure to risk. The Audit Committee of the Board of Directors is also responsible for oversight of compliance with disclosure requirements under applicable laws and regulations, and would be consulted prior to the disclosure of any material cybersecurity incident.


text: The Zoetis information security team regularly provides an information security dashboard to the Audit Committee, covering the most active and relevant threats to Zoetis, relevant trends, and any notable events. At least twice annually, the Zoetis information security team presents updates to the Audit Committee with respect to the information security program, including the status of our security measures and our efforts to identify and mitigate information security risks. The Audit Committee also regularly reviews certain data privacy and cybersecurity metrics as part of the compliance update presented to the Audit Committee.


text: In addition, the Chief Information Security Officer presents updates at least annually to the Board of Directors with respect to the information security program, including the results of our independent, third-party assessment. The Board of Directors also participates in annual table-top exercises involving simulated data security incidents and the Company's responses to those incidents.


text: As a global leader in animal health, we are reliant on complex information systems and digital solutions that make us inherently vulnerable to malicious cyber intrusion and attack. In addition, we have expanded our data and digital capabilities including in our diagnostics portfolio, and as a result, there could be an increased likelihood of a cyberattack or breach of security that could negatively impact us or our customers. Despite the presence of these risks, to date, the identified risks of cybersecurity threats (including as a result of any previous cybersecurity incidents) have not materially affected, and are not reasonably likely to materially affect, us or our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Cybersecurity Program As part of our risk management processes, we have an enterprise-wide cybersecurity program aligned to the NIST Cybersecurity Framework (CSF). Our program is a risk-based program designed to protect our information systems through multiple defenses and layers of security, commonly referred to as a "Defense in Depth" approach. Key elements of our program include:


text: Independent Third-Party Assessments We engage an independent third party to conduct comprehensive assessments of our cybersecurity program approximately every 18 months. This independent third-party assessment includes an evaluation of our cybersecurity controls based on the CSF.


text: We have an information security training program that includes: monthly awareness articles, a phishing training program (with reports reviewed by the Executive Team), and required and optional training modules in our Learning Management System.


text: Management's Role in Risk Oversight Our information security team includes our Executive Vice President, Chief Digital & Technology Officer and our Head of Technology Risk, Compliance and Chief Information Security Officer. Our Executive Vice President, Chief Digital and Technology Officer has over 20 years of information technology experience. Prior to Zoetis, he was the VP, Information Technology at Biogen, overseeing all aspects of Infrastructure, IT Operations, and Enterprise Architecture globally and held various corporate leadership roles at Eli Lilly and Company, including Head of IT Infrastructure and Enabling Functions. He holds a bachelor's degree in information systems and a master of business administration degree. Our Head of Technology Risk, Compliance and Chief Information Security Officer has 37 years of experience in Life Sciences Information Technology, including over 20 years of experience in information security and holds bachelor's degrees in computer science and biology.


text: The Zoetis information security team regularly provides an information security dashboard to the Audit Committee, covering the most active and relevant threats to Zoetis, relevant trends, and any notable events. The Zoetis information security team regularly presents updates to the Audit Committee with respect to the information security program, including the status of our security measures and our efforts to identify and mitigate information security risks. The Audit Committee also regularly reviews certain data privacy and cybersecurity metrics as part of the compliance update presented to the Audit Committee.


text: Risk Management and Strategy We prioritize the management of cybersecurity risk and regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity program.

companyName: Rithm Capital Corp.

ticker: RITM


text: We use a combination of cyber security personnel, documented processes and purpose-driven technologies and monitoring systems to identify, protect, detect, respond and recover from security incidents. These encompass incident response procedures, information security and vendor management and a combination of participation in industry consortiums, continuous monitoring, internal, as well as independent testing of systems, and team member education. Our independent testing includes both (i) periodic testing and evaluations performed by our internal audit firm and (ii) annual network penetration testing conducted through independent third parties. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. As part of these processes, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business (including, but not limited to, SEC rules, the CCPA and the Gramm-Leach-Bliley Act, as further described under the caption "Business—Regulations"), as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: Additionally, in order to reduce cybersecurity risk related to the use of third-party service providers, we (i) obligate our service providers to adhere to privacy and cyber security measures and (ii) perform risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is then ranked in a tier, which tier determines the frequency and extent of evaluation for the service provider. We additionally collect SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents from each of our key service providers.


text: To date, cybersecurity risks, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We do not believe that cybersecurity risks resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect us. Refer to the risk factor captioned "Cybersecurity incidents and technology disruptions or failures could damage our business operations and reputation, increase our costs and subject us to potential liability" in Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the board, in conjunction with the Mortgage and Regulatory Compliance Committee (the "MRC Committee"), which focuses on the risk structure and governance related to the Mortgage Company's mortgage servicing and origination business, oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframe. Audit Committee meetings and MRC Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") on the Company's enterprise risk profile and the Company's risk treatment policies and processes on a quarterly basis or as needed.


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the CISO is focused on assessing, managing, mitigating and reporting on cybersecurity threats and risks.


text: The CISO, in conjunction with the CIO, the Chief Risk Officer and the Chief Legal Officer, manages the Company's cyber security posture. The current CISO has more than 20 years of experience in information security and information technology, including previously serving as the CISO for multiple large multinational corporations. In addition to his extensive work experience, the CISO holds a Bachelor of Science in Business Administration with an emphasis on Management of Information Systems from Alliant University and a Master of Science in Business Administration with an emphasis on Information Systems Audit from California State Polytechnic University. The CISO has the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Fraud Examiner (CFE) and Federal Bureau of Investigations (FBI) CISO Academy Graduate. The CISO reports to the CIO and management on cybersecurity threats on a regular basis.


text: The CISO monitors the Company's cybersecurity posture through the Security Incident Response Team, which consists of key individuals in the legal, human resources, compliance, privacy, risk and information security departments across Rithm Capital and its operating companies. Any escalations will then be raised by the CISO and CIO to Company management who will work with the CISO and CIO to determine the appropriate remediation effort.


text: At the employee level, we maintain an experienced information technology team tasked with implementing our privacy and cybersecurity program and support the CISO in carrying out reporting, security and mitigation functions. We also hold employee trainings on privacy and cybersecurity, as well as records and information management, and we conduct phishing tests. We generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: Risk Management and Strategy We prioritize the management of cybersecurity risk and regularly assess any risk of cybersecurity threats. In doing so, we continuously monitor and test our information systems for potential vulnerabilities pursuant to our cybersecurity program. Our cybersecurity program, led by our interim Chief Information Security Officer ("CISO"), is part of our overall enterprise risk management program, along with other significant risks that we face.


text: Our dedicated cybersecurity personnel supervise and monitor our controls, technologies, systems and other processes utilized to mitigate any data loss, theft, exploitation, unauthorized access or other vulnerabilities that may affect our information or data. Specifically, our cybersecurity program consists of incident response procedures, information security and vendor management due diligence, as well as participation in industry consortiums, ongoing monitoring, internal and independent testing of information systems and continuous employee education and simulations. Our independent testing includes both (i) periodic testing and evaluations performed by our internal audit team and (ii) annual network penetration testing conducted through independent third parties. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. As part of these processes, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business (including, but not limited to, SEC rules, the CCPA and the Gramm-Leach-Bliley Act, as further described under the caption "Business—Regulations"), as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: Additionally, in order to reduce cybersecurity risks related to our use of third-party service providers, we (i) obligate our service providers to adhere to strict privacy and cybersecurity measures and (ii) perform risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is assigned a tiered risk rating, which determines the frequency and extent of evaluation for the service provider. Furthermore, we collect and evaluate SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents for our key service providers.


text: To date, cybersecurity risks, including those resulting from any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations or financial condition. We do not believe that cybersecurity risks resulting from any previous cybersecurity incidents, of which we are aware, are reasonably likely to materially affect us. Refer to the risk factor captioned "Cybersecurity incidents and technology disruptions or failures could damage our business operations and reputation, increase our costs and subject us to potential liability" in Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our board of directors oversees the Company's risk management program, including our cybersecurity program, both directly and through several committees created as part of our risk governance program. Specifically, the Audit Committee of the board, in conjunction with the Regulatory Committee (the "Regulatory Committee"), which focuses on the risk structure and governance related to regulatory risk throughout all lines of business, oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframe. Audit Committee meetings and Regulatory Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the CISO and Chief Information Officer ("CIO") on the Company's enterprise risk profile and the Company's risk treatment policies and processes on a quarterly basis or as needed. Additionally, we have protocols by which certain cybersecurity incidents are escalated in a timely manner to the Audit Committee and the board of directors.