text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our management team is informed of and monitors the prevention, detection, and mitigation of cybersecurity threats and incidents.


text: Our information security program is managed by a dedicated Chief Information Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Chief Information Officer provides periodic reports to our Board of Directors, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: NorthEast Community Bancorp, Inc./MD/

ticker: NECB

secItem: Item 1C

stage1Category: Management Role

stage1Method: unanimous


text: Nutex manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: Nutex Health Inc.

ticker: NUTX


text: Our cybersecurity program is managed by our Information Technology Manager and Chief Operating Officer. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the Information Technology Manager and Chief Operating Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.

stage1Category: Board Governance

stage1Method: majority


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Information Technology Manager and Chief Operating Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.

stage1Category: Risk Management Process


text: We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We will perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business Operations," which disclosures are incorporated by reference herein.

companyName: Molecular Templates, Inc.

stage1Category: None/Other


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Information Technology Manager and Chief Operating Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Information Technology Manager and Chief Operating Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Information Technology Manager has 17 years of information technology experience across multiple industries before joining Nutex Health.


text: As of December 31, 2023, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes, which are effected principally through an outside information technology management/cybersecurity consultant and a computer security firm that we have engaged, include procedural and technical safeguards, response plans, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. Our computer security firm serves as our managed security services provider, and its services include managed detection and response, incident management, managed security awareness and a quarterly risk assessment. Our information technology management/cybersecurity consultant has responsibility for managing detection and incident response in consultation with out our managed security services provider. We considered the internal risk oversight programs of our information technology management/cybersecurity consultant and our managed security services provider before engaging them. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: KALA BIO, Inc.

ticker: KALA


text: While we have not experienced any material losses relating to cyber-attacks, in 2019 we were the subject of a successful phishing attempt. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

stage1Category: Strategy Integration


text: The Audit Committee of our Board of Directors, or the Audit Committee, provides direct oversight over cybersecurity risk. Our Audit Committee and Board of Directors receive periodic updates from our Chief Legal Officer and Chief Compliance Officer, together with our outside information technology management/cybersecurity consultant, and the Audit Committee and Board of Directors is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Chief Legal Officer and Chief Compliance Officer is responsible for the management oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us to address cybersecurity risks. Our Chief Legal Officer and Chief Compliance Officer has many years of experience overseeing company-wide legal and compliance risks, including at multiple publicly-traded companies. Our Chief Legal Officer and Chief Compliance Officer is supported by our outside information technology management/cybersecurity consultant and our managed security services provider.


text: We have also established a cross-functional Cybersecurity Committee led by our Chief Legal Officer and Chief Compliance Officer serving as the chair and consisting of senior leaders within our organization. The Cybersecurity Committee, with assistance from our outside information technology management/cybersecurity consultant, oversees our cybersecurity policy, which includes risk assessment, investments in cybersecurity technologies, cybersecurity insurance and review of relevant information technology policies.


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with periodic cybersecurity training. This training program covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all cybersecurity incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, ("NIST"), and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including deployment of threat monitoring and mitigation solutions, regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats;


text: run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies;


text: leverage internal incident response plans and procedures to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation, including coordination with public relations and internal and external communications teams.


text: As part of the above processes, we regularly engage with third parties to review our cybersecurity program and help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. We generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

stage1Category: Third-Party Risk


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity scorecard / dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our head of Information Technology. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our head of Information Technology. Such individuals have collectively over 6 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. As a financial services company, cybersecurity threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This strategy includes employee training, innovative technologies, and policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response.


text: The Company leverages a variety of industry frameworks and regulatory guidance to develop and maintain its information systems and cybersecurity program, including but not limited to Interagency Guidelines Establishing Information Security Standards, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook (with particular emphasis on the FFIEC's Information Security and Business Continuity Management Handbooks), FFIEC Cybersecurity Assessment Tool, Gramm-Leach-Bliley Act ("GLBA") 501(b), and the Center for Internet Security ("CIS") Critical Controls Framework. In addition, the program leverages certain, third-party benchmarking, audits, and third-party threat intelligence sources to facilitate and enhance the effectiveness of the program.


text: Core activities supporting the Company's strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Company and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups stored at off-site locations and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Our Chief Operating Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Precipio, Inc.

ticker: PRPO


text: Cybersecurity Governance Management Oversight. The Chief Technology Officer oversees the Information Technology Department which, among other things, is responsible for identifying, assessing and managing material risks from cybersecurity threats and has more than thirty years of experience in the information technology field. The Chief Technology Officer is a member of various management committees and participates in Board of Directors' meetings as well as Audit Committee meetings where the overall status of information technology and security is discussed including the related policies and risk assessments. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for policy and program enhancements.


text: Further, the Chief Technology Officer is a member of the Compliance Committee chaired by the Chief Compliance Officer, which consists of members of senior and executive management, as is it charged with maintaining Bank-wide compliance with relevant statutes, regulations, and interpretations as well as consumer protection.


text: Board Oversight. The Board of Directors is responsible for reviewing the overall policies and practices for risk management, including delegation of oversight for particular areas of risk to the appropriate subcommittees. Collectively, the Board of Directors and its subcommittees are responsible for discussing with management major financial risk exposures as well as significant operational, compliance, reputational, strategic and cybersecurity risks, and the steps management has taken to monitor and manage such exposures to be within the Company's risk tolerance.


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. Third parties are also incorporated into our approach to cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, cybersecurity maturity assessments or consulting on best practices to address current and new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: Risk management and strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our IT Manager and Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Operating Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Risk management and strategy Our accounting and financial reporting platforms and related systems, and those that we, or our third-party service providers, offer to our tenants are necessary for the operation of our business. We use these platforms and systems, among others, to manage our tenant relationships, for accounting and financial reporting, and for other recordkeeping purposes. Our business operations and financial reporting rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Trinity Place Holdings Inc.

ticker: TPHS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on our management and third-party service providers to manage any perceived cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, internal controls within our accounting and financial reporting functions, network security controls, access controls, physical security, systems monitoring, and employee training.


text: We work with third parties from time to time that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms and information technology consulting and support firms. To operate our business, we utilize certain third-party service providers to perform a significant portion of our critical functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. To address risks associated with third-party service providers, we will review and assess the cybersecurity controls of our third-party service providers and make changes to our business processes to manage these risks. This approach is designed to mitigate risks related to data breach or other security incidents originating from third-party service providers.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Steven Kahn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Kahn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2015. Mr. Kahn currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Kahn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any serious cybersecurity incidents to our Board.


text: Cybersecurity Risk Management and Strategy We, through our third -party service provider that manages our information technology systems and networks, have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: FENNEC PHARMACEUTICALS INC.

ticker: FENC


text: Our security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, ensure maintenance of backup and protective systems, and engage with a Managed Service Provider who has a team of security personnel managing our efforts and initiatives. We review System and Organization Controls 1 (SOC 1 Type II) certifications where relevant from key third party partners and other service providers with access to information assets at least annually.


text: We maintain Information Systems Incident Management Standards that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our internal controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment designated team members are responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and Maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any cybersecurity threats that have materially affected the Company.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and oversees our cybersecurity and other information technology risks and management's implementation of our cybersecurity risk management program.


text: Our Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board and the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program and supervises our retained provider of IT services and external cybersecurity consultants. Our Chief Financial Officer has experience supervising and managing company security and privacy departments.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess, and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company engages a third-party provider to conduct periodic maturity assessments. The Company stores data in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: Our cybersecurity program is managed by the Annovis Incident Management Committee (the "AIMC"). The AIMC serves as the core team responsible for managing the enterprise-wide cybersecurity policy, maintenance and compliance across all platforms. The AIMC is responsible for the detection and initial assessment of potential cybersecurity threats and incidents. The AIMC classifies detected cyber incidents to allow prioritization, response and escalation. Incidents are documented for internal reporting processes and regularly shared with senior management.


text: Our third-party IT service provider is a key part of our cybersecurity program. We partner with a cybersecurity company and leverage their technology and expertise to better protect the Company. From time to time, we engage this vendor to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. We intend to continue to work to formalize our cybersecurity program, including developing processes for third-party service provider cyber-risk oversight and management.


text: In the event of a potential cybersecurity incident, the AIMC will conduct an assessment to determine the nature and scope of the incident and manages the incident in accordance with our incident response plan until the incident is contained and resolved. The AIMC will document findings and make them available to the Disclosure Committee, which includes cross functional senior management representation from, legal, finance, investor relations and business segments. The Disclosure Committee, in conjunction with third-party experts, including outside legal counsel, is responsible for assessing the materiality of any cybersecurity incident and coordinating external communications and disclosures, including with the Securities and Exchange Commission.


text: As of December 31, 2023, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition, although we may be materially affected in the future by such risks or future material incidents. See "Risk Factors—Risks Related to Our Business Operations—Disruption, failure or cyber security breaches affecting or targeting computers and infrastructure used by us or our business partners may adversely impact our business and operations" for additional information regarding cybersecurity risks.


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for the Annovis management and Board of Directors. We continue to invest in cybersecurity and enhance our internal controls and processes, which are designed to help protect our systems and the information they contain.


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board has delegated to the Audit Committee the responsibility to oversee the integrity of the Company's information technology and cybersecurity risks and to assess the risks and incidents relating to cybersecurity threats. While our Board and Audit Committee oversee cybersecurity risk, management, through the AIMC, is responsible for the implementation and management of cybersecurity risk management systems and processes and for the communication of incidents to senior management and the Audit Committee.


text: The AIMC meets with the Audit Committee on a quarterly basis and meets with the BOD at least annually. Additionally, the Audit Committee regularly meets with members of the Company's internal audit function to discuss risk management activities, compliance, best practices, and other related matters.


text: Risk Management and Strategy We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion. Our internal auditors perform audit engagements to assess our strategies, policies, procedures, and controls to reduce the risk of a cybersecurity incident.

companyName: BATTALION OIL CORP

ticker: BATL


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. With the assistance and advice of our expert consultants, responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our Director of Information Technology, who reports to our Chief Executive Officer.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into our compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee of the Board having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cybersecurity, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.


text: In addition, the Audit Committee, with the assistance and advice of Company management and third-party consultants, oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The Audit Committee receives quarterly reports from Company management, which includes cybersecurity risk factors.


text: The Board routinely receives information and updates from Company management and the Audit Committee with respect to the effectiveness of the Company's information systems' security framework, which may include cybersecurity assessments, risk management, and mitigation measures. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts.


text: We have not identified an indication of a substantive cybersecurity incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A Risk Factors above.


text: Risk management and strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: Risk Management and Strategy We monitor our information systems for potential cybersecurity issues and assess risks from cybersecurity threats as an element of our overall business risks. To protect our information systems from cybersecurity threats, we use various security tools supporting protection, detection, and response/mitigation capabilities. We also alert employees to significant new cybersecurity issues on a regular basis.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Compliance Officer to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training sessions.


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures and monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Financial Officer and Chief Compliance Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer and Chief Compliance Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats and plans and strategies to address threats and incidents.


text: Our Chief Compliance Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: The audit committee oversees risks related to cybersecurity, including the security of corporate information and the steps management is taking to monitor and control these risks. Management regularly briefs the audit committee on our cybersecurity risk profile, potential threats, and continuous improvement initiatives. Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, enhancing our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Risk Management and Strategy We engage a third-party Managed Service Provider (MSP) to implement technology infrastructure and oversee its tactical operations. Our MSP employs multiple people with experience in technical leadership, system architecture, network infrastructure and cybersecurity. We believe using an MSP provides economies of scale for a smaller-sized company such as ours, by allowing us access to a broad range of experience and tool sets that would otherwise be difficult to acquire in-house. Our MSP uses specialized third-party services and tool sets for identifying, protecting against, and detecting cyber incidents. Through these services and tools, our detection capabilities include, but are not limited to, near real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide near real-time alerts, log aggregation, and threat intelligence feeds.


text: In addition, we engage cybersecurity consultants, unaffiliated with our MSP, to advise management, assess our technology tools and review our cybersecurity practices. Our consultants utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess our cybersecurity risk and governance practices. The NIST Cybersecurity Framework enables organizations, regardless of size, to apply principles and best practices of risk management to improve security and resilience.


text: Material Impact of Cybersecurity Threats While to date we are not aware of any material information security breaches and have not incurred significant operating expenses related to information security breaches, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the risks related to our business section for more information. Our incident response practices require incident assessments to be conducted in concert with our CEO, CFO and MSP. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: TREVENA INC


text: We have leveraged the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. We provide ongoing training to our employees to identify and understand the risks from cybersecurity threats, Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;


text: an outsourced security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training for our employees, incident response personnel, and senior management. This includes mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), our outsourced security team has a written incident response plan outlining how to address cybersecurity events that occur. We have assigned a team comprised of finance and technology personnel to review the plan annually to serve as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. In addition to the cybersecurity incident response plan, our outsourced team conducts tabletop exercises to enhance our incident response preparedness. They also have processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. Such processes include conducting due diligence and risk assessment of our current and potential vendors that examine such vendor's cybersecurity protocols and adherence to applicable regulations.


text: We also maintain business continuity and disaster recovery plans to prepare for and respond to the potential for any disruption in the technology we rely on. Additionally, we maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: We designed a multi-faceted risk-management approach based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and informed by other industry standards and industry-recognized practices to identify and address cybersecurity risks. Our key cybersecurity processes include the following:

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Governance Related to Cybersecurity Risks Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our Senior Vice President, Chief Business Officer and Head of Commercial Operations is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Vice President, Chief Business Officer and Head of Commercial Operations has nearly 10 years of experience overseeing information technology activities.


text: Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.


text: Cybersecurity Risk Management and Strategy In the normal course of business, we may collect and store personal information, customer information, and certain sensitive company information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding trial participants in connection with clinical trials, sensitive third-party information, and employee information. To protect this information, our existing cybersecurity policies require monitoring and detection programs, network security measures, and encryption of critical data. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We have established our disaster recovery plan, and we protect against business interruption by backing up our major systems. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Zomedica Corp.

ticker: ZOMDF


text: Our cybersecurity program is led by our Vice President of Technology Innovation and includes a team of information technology professionals. The program is further strengthened through support of our General Counsel. These teams work closely together to support and bolster our cybersecurity program, which incorporates industry-standard frameworks, policies, and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity team informs our Audit Committee on information security and cybersecurity matters as needed.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to our Business" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Cybersecurity risk management and strategy The Company integrates risk management into its overall cybersecurity strategy and has implemented processes designed to identify, assess, prioritize, and manage risks to protect data, intellectual property, and information assets. As part of our risk governance and management, the Company has developed procedures to; identify and evaluate risks, measure them against predefined criteria, devise and execute strategies to mitigate identified risks, continuously monitor and review risk profiles, and communicate risks to relevant stakeholders. Addressing cybersecurity risks involves a comprehensive approach that encompasses both internal assessments and external information sources. For instance, the Company engages in security assessments conducted by internal and external experts to ensure compliance with security policies and industry frameworks; and vulnerability assessments to discover vulnerabilities in networks, systems and applications. The Company has strategically reduced its hardware footprint by eliminating on-premise datacenters and moving IT infrastructure into cloud-hosted and Software as a Service (SaaS) providers. As a result, the Company is streamlined and agile to respond quickly to market fluctuations and changes in the industry. Additionally, the Company leverages cloud-hosted and SaaS providers that offer Service Level Agreements (SLAs) and adhere to compliance and regulatory requirements for the industry. We oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk. The Company performs ongoing risk assessments that evaluate IT systems and assess the likelihood of occurrence, estimate potential impact, and plan for remediation.

companyName: Vireo Growth Inc.

ticker: VREOF


text: Cybersecurity Governance Cybersecurity risk management is overseen by the Company's Vice President of Information Technology and Security who is supported by full-time information security staff. The Vice President of Information Technology and Security advises the executive team on the development and implementation of the information security program.


text: The Company incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, the Company has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, " We face risks related to our information technology systems, including potential cyber-attacks and security and privacy breaches ".


text: The Board and executive team provide regular oversight of the Company's cybersecurity risk management program. The Vice President of Information Technology and Security presents to the Board and the executive team regularly with updates via business review dashboards. The Board and executive team provide guidance, including with respect to any changes to business priorities, risk tolerance, or security initiatives.


text: We rely heavily on third party service providers for our clinical development activities and cloud-based documentation and communications. A cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. Third-party vendor cybersecurity risks and procedures are evaluated by our Quality Assurance and Regulatory Department during our prequalification process and during subsequent periodic reviews.


text: We do not specifically utilize assessors, consultants, auditors, or other third parties to evaluate or enhance our cybersecurity programs. On an annual basis, our information technology risks, controls and procedures are reviewed by third-party experts as part of our Sarbanes-Oxley review and testing.


text: Board Governance and Management Our board of directors has oversight responsibility for risk management, which it administers directly and with assistance from its committees, primarily the audit committee. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks, including cybersecurity.


text: The audit committee assists the board of directors by overseeing the steps management has taken to monitor and mitigate cybersecurity threats and risks. The audit committee receives reports annually from management on our cybersecurity strategy and program. Significant changes are reported to the audit committee quarterly. Cybersecurity incidents which are determined by management to be material will be reported immediately to the audit committee.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity procedures designed to address cybersecurity threats and risks. The Director – Information Technology, who has a combination of 15 years of professional experience and education, as well as certifications in cybersecurity, leads the Company's cybersecurity program and is responsible for assessing and managing cybersecurity risk. The Director- Information Technology reviews cybersecurity risks with and reports cybersecurity incidents to the Chief Executive Officer, Chief Operating Officer/Chief Financial Officer, and Senior Director – Financial Reporting.


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for us to be adversely impacted. This impact could result in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. See "Part I —Item 1A. Risk Factors" for further discussion of these risks.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under NIST.

companyName: DISH DBS CORP


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and EchoStar's Board of Directors as a whole to ensure accountability.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future. On February 23, 2023, we experienced a network outage that affected its internal servers and IT telephony. We immediately activated our incident response and business continuity plans designed to contain, remediate and recover from the situation. We engaged the services of certain cyber-security experts and outside advisors to assist in the evaluation of the situation, and once we determined that the outage was due to a cybersecurity incident, we promptly notified appropriate law enforcement authorities. In addition, on February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems.

stage1Category: Incident Disclosure


text: After investigation and discussions with certain third parties, we determined that our customer databases were not accessed, however, we confirmed that certain employee-related records as well as a limited number of other records containing certain personal information were among the data extracted. We took steps to protect the affected records, received confirmation that the extracted data was deleted and notified individuals whose data was extracted.


text: The DISH TV and SLING TV services remained operational at all times during the incident. As of March 31, 2023, all significant systems had been restored. We have no reason to believe that this cybersecurity incident has not been concluded.


text: We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: The Chief Information Security Officer ("CISO") leads our information security organization responsible for overseeing our information security program. The CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, EchoStar's Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.


text: In connection with the Integration, we anticipate that we will continue to evaluate and address as needed our cyber security risk management, policies, structure, strategies and governance to meet our needs.


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.


text: The Technology Advancement Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Technology Advancement Department is managed by the Board-appointed Chief Information Officer (the "CIO") who reports directly to the Company's Chief Executive Officer. The CIO has more than 12 years of experience with the Company and additional years of experience in the information technology ("IT") field. The CIO also oversees the Company's Cybersecurity Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Cybersecurity Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Technology Advancement Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Security Steering Committee, and presents information security and cybersecurity updates on a monthly basis to the Company's Board of Directors.


text: Program Adjustments. The CIO monitors, evaluates, and adjusts the Cybersecurity Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: As referenced above, the CIO provides information security updates to the Board of Directors at each Board meeting. Additional information security training to the committee is provided through a management Information Security Steering Committee and also through targeted training overseen by the CIO. In addition, as discussed below, the Company has implemented an Incident Response Plan, which is integrated into its Cybersecurity Policy, to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and is subject to annual review and approval by the Board of Directors. Cybersecurity metrics are reported to both management level committees and the Board of Directors on a monthly basis.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Cybersecurity Program.


text: Risk Assessment. On a periodic basis, but not less than annually, the Chief Information Officer, in conjunction with the Board of Directors, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Cybersecurity Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Board of Directors changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. Ensuring that changes to security configurations are documented, approved, and tested. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. Conducting subsequent penetration testing and vulnerability assessments, as warranted.


text: Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: Service Providers. Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Vendor Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive the Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Vendor Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the CIO reports to the Board the overall status of the Cybersecurity Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Board of Directors Oversight The board of directors is responsible for the oversight of cybersecurity risk management and is composed of members with expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CIO is responsible for implementing and maintaining the IRP, which includes:


text: Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.


text: Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.


text: Reviewing the IRP at least annually, or whenever there is a material change in The Company's business practices that may reasonably affect its cyber incident response procedures.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: Primary responsibility for executing our cybersecurity program rests with our Vice President of Corporate Strategy and Planning, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of related work experience. The Vice President of Corporate Strategy and Planning is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Executive Officer. The Vice President of Corporate Strategy and Planning at times attends meetings of the Board to report on any material developments to our risk management practices, including our cybersecurity program.


text: The Vice President of Corporate Strategy and Planning meets regularly with members of our Information Technology team, whose responsibilities are dedicated solely to cybersecurity matters. On a quarterly basis, we hold Information Technology Steering Committee meetings, which are attended by our Information Technology team, Chief Executive Officer and Chief Financial Officer, where we discuss the risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Our Information Technology team also works with our Vice President – General Counsel to oversee compliance with legal, regulatory and contractual cybersecurity requirements.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our Information Technology team. We regularly conduct vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.


text: Our Board has the primary responsibility to oversee cybersecurity matters. The Board periodically reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board receives reports from the members of our management team responsible for executing our cybersecurity program, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board discusses with such members of our management team our information technology systems and procedures on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board in a timely manner.


text: We have adopted an Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third-party vendor on retainer to assist in such incidents.


text: Information sharing and collaboration – We utilize threat intelligence and security information collected from various sources, including but not limited to partners, suppliers, governments and information sharing and analysis centers, to identify, protect against, detect and respond to potential cybersecurity threats and events.


text: As detailed elsewhere herein, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.


text: Risk Management and Strategy The Company has developed and maintained a comprehensive cybersecurity program which is integrated within the Company's enterprise risk management program and encompasses the corporate and operational technology environments, as well as client-facing products and services. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity incidents and risks within an ever-changing threat landscape. We utilize cybersecurity policies and frameworks based on industry and government standards, including the National Institute of Standards and Technology Cyber Security Framework (" NIST CSF "). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Our cybersecurity program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incident. The Company operates a 24 x 7 security operations center (" SOC ") which monitors our global cybersecurity solutions and production environments, and serves as a central location for the reporting of cybersecurity matters. The roles and responsibilities of the SOC and our cybersecurity team in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation.


text: We partner with third parties to support and evaluate our cybersecurity program. Provided third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing and consulting on best practices. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our data or our systems. Third-party risks are included within our risk assessment of vendors, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We also implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We communicate these and other pertinent security issues or compliance changes through our regular internal communications cadence. Additionally, the Company has mandatory security awareness training addressing cybersecurity, privacy and confidential information.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In June 2022, ETI experienced a previously disclosed network security incident which had material adverse impact and required ETI to, among other things, limit access to its applications and services by its employees and customers. In response, ETI incurred considerable costs to restore the security of its internal systems and networks and adopted various enhancements. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. Please refer to " Item 1A. Risk Factors " for further information about the material risks associated with various cybersecurity threats.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management and compliance programs.


text: Our cybersecurity program is led by our Chief Technology Officer (" CTO "), who has two decades of experience in various cybersecurity, software development, product management, and other technology-related roles. Our CTO oversees teams across the company supporting our security functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions.


text: Our Audit Committee receives periodic reports from our CTO and management on our cybersecurity risks and the current threat landscape trends. In addition, management will update the Board directly, as necessary, regarding cybersecurity incidents. The full Board also receives presentations on cybersecurity topics from our CTO and other security management staff as part of the Board's continuing education on topics that impact the Company.


text: Risk Management and Strategy Our Information and Technology service providers manages the Company's security program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and board of directors, described below under "Governance."

companyName: Vyome Holdings, Inc

ticker: HIND


text: To proactively manage cybersecurity risk in our organization, our management team has instituted a security policy that is available to all employees.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Technology providers identifies and addresses known cybersecurity risks on a continuous basis. In addition, we stive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Executive Officer or Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings.


text: RISK MANAGEMENT AND STRATEGY Securing Kroger's business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our businesses, meeting applicable regulatory requirements and maintaining the trust of our stakeholders. We have adopted enterprise cybersecurity risk mitigation and governance processes, which are set forth in the Kroger Cybersecurity Risk Management program ("CRM"), the Kroger Third-Party Cybersecurity Risk Management program ("TPCRM"), and the Kroger Cyber Incident Response Plan ("IR Plan"). Our approach is guided by the principles of the CRM, which includes monitoring threats and vulnerabilities and assessing and monitoring related controls, supporting the Corporate Information Security function, the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"). Kroger's cybersecurity policies, standards, processes, and practices are integrated into our overarching risk management system in an effort to enhance our ability to safeguard our operations and information, which includes quarterly cybersecurity reporting to the Board, delivered by senior leadership.

companyName: KROGER CO

ticker: KR


text: Kroger Cyber Risk Management Program The CRM was developed in collaboration with third-party consultants and is aligned with the National Institute of Standards and Technology ("NIST"), Risk Management Framework ("RMF"), Cybersecurity Framework ("CSF") and the International Organization for Standardization 27001 ("ISO 27001"). The program includes security and privacy, risk-based controls, and incorporates lessons learned from cybersecurity incidents. Under Kroger's CRM, cyber risks, including cyber threats and cyber events/incidents, are assessed, treated, and monitored on a continuous basis. We integrate lessons learned from incident response and cyber risk mitigation into our cyber risk management strategy, in an effort to improve overall cybersecurity on an ongoing basis. Kroger's CRM program is spearheaded by specific management positions, chosen for their expertise in the field as further discussed below.


text: In line with cyber risk management best practices, we have collaborated with recognized third-party experts as needed to align the CRM's foundational processes, metrics, monitoring, and reporting with common frameworks such as NIST and RMF.