text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity defense strategy based on prevention, detection and containment. We employ industry standard measures directly or indirectly related to cybersecurity, such as multifactor authentication, endpoint protection defenses, antivirus protection, encryption standards, restricting access based on business necessity, and remote access monitoring. Our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. The training provides employees with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. We engage third parties to conduct penetration testing and evaluate our adherence to industry-standard frameworks. We assess the security framework employed by our third party service providers including their reports on security, availability and confidentiality to assess and identify material risks from cybersecurity threats associated with our use of third party applications. We have also established liaison programs with the Federal Bureau of Investigation ("FBI") and U.S. Cybersecurity & Infrastructure Security Agency ("CISA") to monitor, identify, and counter advanced persistent threats specific to our company and industry. As part of this program, we have an FBI Special Agent assigned as our Liaison Officer who provides us with periodic cybersecurity threat briefings, and also provides counter-threat support on request.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Cyberattacks impacting our networks or systems may have a material effect on our operations."

companyName: AST SpaceMobile, Inc.

ticker: ASTS

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: Governance of cybersecurity risk management Our Board of Directors, acting through the Audit Committee, is responsible for overseeing management's implementation and execution of the risk management process, including our cybersecurity risk management strategy and processes. Our Audit Committee reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management.

stage1Category: Board Governance


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. We have formed a Cyber Security Incident Response Team ("CSIRT") to manage and govern the response to any real or suspected cybersecurity incidents. The CSIRT core team, consisting of the information technology team, classifies detected cybersecurity incidents into one of three categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of cybersecurity incidents is designed to allow rapid prioritization, response and escalation. The CSIRT core team engages with third party experts and cross-functional CSIRT members, as required, to manage the cybersecurity incidents. Cybersecurity incidents that are potentially significant or could result in a material impact are reported to the CSIRT Executive team, consisting of designated executives of the Company. The CSIRT Executive team is responsible for the oversight of the cybersecurity incidents and related critical decisions, performing a materiality assessment, overseeing the public disclosure of material cybersecurity matters, engaging law enforcement agencies, including our local FBI Liaison Officer, correspondence with the media, and communicating with our Audit Committee and Board of Directors, as appropriate.

stage1Category: Risk Management Process


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our board of directors.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: Risk management and Strategy We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have engaged a third-party information technology ("IT") and cybersecurity firm who serves as our dedicated IT and cybersecurity team to help us oversee, implement and manage these processes and controls. This IT and cybersecurity firm is independently audited on an annual basis and has a System and Organization Controls Audit certification.

stage1Method: majority


text: Processes and controls we have implemented with the assistance of our third-part IT and cybersecurity team to assess, identify, manage and protect against material risks from cybersecurity threats include the following: • perform 24/7 security monitoring through an automated detection software managed by our third-party IT and cybersecurity firm; • conduct regular phishing email training for all employees with access to corporate email and other systems to enhance awareness and responsiveness to such possible threats; and • requiring employees, as well as third parties who provide services on our behalf, to treat information and data with care.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to our Incident Response Team. The Incident Response Plan is designed to analyze, contain and remediate any cyber incidents that may circumvent existing safeguards. The Incident Response Plan encompasses a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal and external communication and disclosure protocols. We also maintain data backup procedures in the event of a cybersecurity incident. The Incident Response Plan is evaluated at least annually.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations. See "Risk Factors—Risks Related to Our Business and Properties—Cybersecurity incidents or other technology disruptions could negatively impact our business, our relationships, and our reputation."


text: Cybersecurity Governance As described above, we have engaged a third-party IT and cybersecurity firm to which we have delegated primary responsibility to oversee, implement and manage our processes and controls to assess, identify and manage risks from cybersecurity threats. Management receives monthly reports from the third-party IT and cybersecurity firm regarding cybersecurity incidents and any necessary remedial actions, data security posture and cybersecurity risk management processes and strategies. Management also meets quarterly with the third-party IT and cybersecurity firm to discuss technology and cybersecurity policies and procedures and risks and remediation actions.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the audit committee. As such, our audit committee is responsible for overseeing our overall risk assessment and risk management program as well as our policies and practices related to our information technology systems, information security and cybersecurity risks. Management is responsible for the day-to-day assessment and management of cybersecurity risks. Management works with the third-party IT and cybersecurity firm to identify, assess and manage cybersecurity risks. Our management team includes the chief executive officer and chief financial officer, each of whom has over twenty years of experience in supervising, managing, underwriting, owning, operating and assessing the risks of commercial real estate investments and commercial real estate operating companies. The audit committee reviews at least annually our enterprise risks and related risk management program. In addition, on a quarterly basis, the audit committee receives a report from management on our cybersecurity threat risk management and strategic process covering topics such as cybersecurity incidents and any remedial actions, if needed, data security posture and the results of third-party risk assessments as well as our cybersecurity risk management processes and strategies. Additionally, management would notify the chair of the audit committee following any cybersecurity incident meeting specified security levels, and the audit committee would review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC. Members of our board of directors that are not members of the audit committee are also kept apprised of material risks from cybersecurity threats and our related risk management activities.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: While everyone at the Company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by the Board, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and tenant, employee and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cyberersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.


text: Additionally, we engage third-party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.


text: As of December 31, 2023, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" –"Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" in this Annual Report."


text: With oversight from the Board, the Audit Committee is primarily responsible for assisting the Board in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and protected health information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our information technology department, which is led by our Director of Information Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, and other contractors and suppliers. We also conduct regular employee training on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: BIORA THERAPEUTICS, INC.


text: Our Director of Information Technology, who has over 15 years of experience managing information technology and cybersecurity matters and holds a Master's Degree in computer science with a concentration in cybersecurity, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

stage1Category: Management Role


text: Our Board of Directors, as a whole and at the committee level, has oversight of the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. Our Audit Committee, which is comprised solely of independent directors, oversees our cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Director of Information Technology as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Identifying, assessing and managing cybersecurity risks is an important component of Conifer's overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the Company and its consolidated subsidiaries.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: The Company and each of its consolidated subsidiaries are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access, and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee training; (vi) disaster recovery testing and (vii) security assessments of third-party service providers.


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past three fiscal years, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data (including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, "Information Systems and Data").

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our Information Systems Representative and Chief Operating Officer identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods designed to accomplish this task including, for example: manual and automated tools, subscriptions to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, and evaluating threats reported to us.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response strategies, systems monitoring, personnel training, cybersecurity insurance, data encryption strategies, network security controls, access controls, physical security controls, and asset management (such as tracking and disposal of Company information systems).


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT Department works with management in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers and professional services firms (including legal counsel). We also use service providers to perform a variety of functions throughout our business, such as application providers, data hosting providers, and CROs. We have a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategies may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, such as reviewing their information security documentation and imposing contractual obligations on them with respect to their information security controls.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could result in adverse consequences including, but not limited to, regulatory investigations or actions, litigation, fines/penalties, disruptions of our business operations, reputational harm, and loss of revenue or profits.

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, threats, risks and mitigation. Our Audit Committee also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: Our Information Systems Representative, in coordination with senior management including our Chief Operating Officer works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout our company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the Information Systems Representative and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. The Information Systems Representative has served in various roles in information technology and information security for over 25 years, including serving as the Director of Information Technology of another public company. Our Chief Operating Officer has over 7 years of experience managing information technology, including cybersecurity and risk management.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Terran Orbital Corp


text: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk and is aligned to our business goals and strategy. Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • the use of technologies, products, specialized IT tools and external service providers, where appropriate, to assess, test, understand, manage, mitigate and continually remediate identified risks, or otherwise assist with aspects of our security procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.


text: All cybersecurity risks are logged into our cybersecurity risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident that could have a material negative impact. For more information about these risks, please see "Item 1A. Risk Factors - Cyber-attacks and other security threats and disruptions could have a material adverse effect on our business" in this annual report on Form 10-K.


text: Cybersecurity Governance It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Our information security program is managed by our Senior Vice President and Chief Information Officer ("CIO"), who has over 25 years of IT Risk Management experience. The CIO's cybersecurity team, which includes a team of personnel with more than 30 years of collective information and product security experience, ranging from early-career professionals with cybersecurity degrees to seasoned professionals with multiple cybersecurity-related certifications, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic reports to our management team and our Board, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of related projects, assessments, and emerging threats. Our cybersecurity program is regularly evaluated and reported on to senior management and the Board.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: New York REIT Liquidating LLC


text: This cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: DECEMBER 31, 2023 As we are fully externally advised, we are reliant on our external advisor's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our advisor's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.


text: We are a blank check company with no business operations. Since the date of the IPO, our sole business activity has been identifying and evaluating suitable Business Combination candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of any risks from cybersecurity threats. We have not encountered any cybersecurity incidents since inception.

companyName: Generation Asia I Acquisition Ltd


text: Our Board of Managers (the "Board") considers cybersecurity risk as part of its risk oversight function. In March 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Chief Financial Officer on our cybersecurity risks. In addition, our Chief Financial Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems. Our Board of Directors will also receive briefings from our Chief Financial Officer on our cybersecurity risk management program as part of our overall business risk updates.


text: Our management, represented by our Chief Financial Officer, oversees the Company's cybersecurity risk management program. Our advisor has elected to engage third-party providers to maintain its network defenses and to manage and assess cybersecurity risk management and strategy for the Company. Our advisor's third-party provider updates our Chief Financial Officer and members of our advisor's management team with any network issues on a monthly basis and makes recommendations for security upgrades as needed. Our Chief Financial Officer takes these recommendations into account in deciding which upgrades to implement. Our Chief Financial Officer will update the Audit Committee quarterly, or more frequently in the case of a significant cybersecurity incident impacting our information systems.


text: Risk Management and Strategy We have developed a cybersecurity program intended to protect the confidentiality, integrity and availability of our systems, data, and products. Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including customized annual training requirements, threat monitoring and detection tools, threat containment methods, risk assessments, and security requirements for our suppliers and other third parties. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable. At least annually, we undertake several assessments to evaluate our cybersecurity controls.

companyName: Acorda Therapeutics, Inc.


text: Management has established an incident response plan designed to assess, identify and manage risks from cybersecurity threats and enable prompt response in the event that a cybersecurity incident is detected. We have a process in place for notification to our leadership response team in the event of a significant cyber incident, and for escalation of these events to our Audit Committee and Board, as appropriate. To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations, or financial condition.


text: The Audit Committee of the Board of Directors oversees our cybersecurity program. It considers cybersecurity risk individually and within our overall risk management framework. We obtain periodic assessments of our information technology systems, including cybersecurity, the results of which assessments are reported to the Audit Committee. During meetings, our Vice President, Information Technology and executive leadership updates the committee on Acorda's cybersecurity posture, potential threats and risk mitigation strategies, and the progress of the Company's cybersecurity initiatives, as appropriate. The Chair of the Audit Committee and management provide regular briefings on such matters to the full Board of Directors, as appropriate.


text: Our Vice President, Information Technology is primarily responsible for leading our cybersecurity program through our information technology team. Our Vice President, Information Technology has over 20 years of experience in information technology, and regularly reports on cybersecurity matters to our Audit Committee. Our Vice President, Information Technology reports directly to our Chief Financial Officer, who is a member of our executive leadership team and reports directly to our Chief Executive Officer. As of December 31, 2023, our Information Technology team consisted of team members and contractors, many of whom have advanced degrees and cybersecurity-related industry certifications. Under the direction of our Vice President, Information Technology, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to continually enhance our cybersecurity program in response to such developments.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our SafetySmart platform ("Information Systems and Data").

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Our information security and engineering functions, led by our Vice President of Operational Engineering, help identify, assess and manage the Company's cybersecurity threats and risks. These teams identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our industry's risk profile using various methods including, for example manual and automated tools (including firewalls and endpoint protection); subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our environment; evaluating threats reported to us and coordinating with law enforcement concerning certain threats; conducting threat assessments of both internal and external threats; conducting vulnerability assessments to identify vulnerabilities; working with third-parties to conduct testing and tabletop exercises; and using external threat intelligence feeds.


text: Depending on the environment and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response and detection policy and processes; vulnerability management processes; a secure software development lifecycle policy and change management procedures; business continuity plans; penetration tests; encrypting certain data; using network security controls; segregating and maintaining access controls over certain data; asset management and tracking; training our employees; and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; penetration testing firms; darkweb monitoring services; and managed detection and response providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and network and cellular communications providers. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including for example, conducting risk assessment of certain vendors, providing our vendors with a security questionnaire or reviewing their SOC report, reviewing the vendor's written information security program in certain circumstances, conducting audits of our vendors as may be needed, and requiring certain technical controls of our vendors through contractual obligations.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risks titled "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation or mass arbitration demands; fines and penalties; disruptions of our business operations; reputation harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Operational Engineering, Dave Halliday. Mr. Halliday has over thirty years of experience in information technology and information security management and oversees our operational engineering component, which includes our information security function, IT, networking, cloud operations, and development operations teams.


text: Mr. Halliday is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Financial Officer, and the Vice President of Operational Engineering. Those members of management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Chief Financial Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Cybersecurity Approach and Strategy Our cybersecurity approach includes consideration of information security controls in aspects of the business where unauthorized occurrences could adversely affect the confidentiality, integrity, or availability of our information systems as part of our overall risk management strategy, looking to the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guide in how we identify, assess, and mitigate material cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cybersecurity governance, prevention, detection, and remediation activities within our Company's cybersecurity environment.

companyName: Leafly Holdings, Inc. /DE


text: We have engaged external cybersecurity professionals to help design and manage our security program. These experts conduct annual penetration testing and incident response tabletop exercises, make recommendations on how to continuously improve our cybersecurity program, and assist us in implementing their recommendations into our existing processes.


text: Accordingly, we have implemented processes for overseeing, detecting and identifying material risks from cybersecurity vulnerabilities and threats, and technical, process, and people related security controls designed to mitigate material cybersecurity risks. We also maintain an Incident Response Plan, which defines the procedures for evaluating, and reporting cybersecurity incidents to executive leadership. The Incident Response Plan also creates a framework and delegates tasks to appropriate personnel for responding to a cybersecurity incident based on the severity of an incident. These processes are integrated into our overall risk management strategy.


text: Our ongoing cyber risk management efforts include penetration testing to assess and manage cybersecurity risks and monthly reviews of our risk register, which are updated on an ongoing basis. From time-to-time, we also provide enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.


text: We have experienced security incidents in the past, which we believe were immaterial and were not reportable under applicable state law or our other obligations; however, there can be no assurance that our determinations were correct. We do not believe there are material risks from cybersecurity threats, including as a result of previous incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Oversight of Third-Party Service Providers We manage cybersecurity risks through our use of third-party service providers by integrating our mitigation strategies throughout various functional areas within the Company, including but not limited to the Company's business segments and information technology, engineering, infrastructure, and legal departments. These strategies include, as applicable, conducting technical assessments at the outset of any third-party service provider engagement, limiting the disclosure or transfer of information to an as-needed basis by way of technical infrastructure, and contractually requiring third parties to maintain security controls and protect our information and maintain established notification protocols in the event of any known material data breach using industry best practices.


text: Our Senior Vice President of Product, who has extensive cybersecurity knowledge from over 20 years of experience in leadership roles at technology companies ranging in maturity from various startups to Sony, a large billion dollar corporation, leads the team responsible for overseeing, managing, and assessing our material cybersecurity risks, and works in close coordination with other members of leadership, infrastructure, and information technology, and our external professional providers to maintain cybersecurity risk management and data protection.


text: Our Board oversees the risk management activities designed and implemented by our management. Our Board executes its oversight responsibility both directly and through its committees, and has delegated the responsibility of providing oversight of cybersecurity risks to its Audit Committee, including oversight over the steps management takes to monitor and control such exposures. Our Senior Vice President of Product and external cybersecurity professionals are responsible for overseeing, managing and assessing material cybersecurity risks, and periodically report to the Audit Committee on the ongoing development, status and health of our cybersecurity program and material cybersecurity risks or incidents, if any.


text: The Board recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: STRYVE FOODS, INC.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: No risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Stryve's business, financial condition, results of operations and relationships with customers. We describe whether and how risks related to cybersecurity threats are reasonably likely to materially affect us, including our business, financial condition, results of operations and relationships with customers, in Item 1A of this Annual Report on Form 10-K.


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Financial Officer. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management is responsible for developing cybersecurity programs. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees, and prior work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Risk Management and Strategy The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program is designed to allow us to identify, assess, and manage cybersecurity risks. Our Chief Technology Officer, with the support of our IT Manager, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Technology Officer has 30+ years of experience leading and managing consumer facing services at scale. He has a Bachelor of Science in Computer Science and has led and managed both engineering and Enterprise IT teams across large scale organizations focused on delivering secure and performant consumer products. Our Chief Technology Officer also works closely with other management positions to ensure that the Company understands its cybersecurity risk management responsibilities.

companyName: Interactive Strength, Inc.

ticker: TRNR


text: To operate our business, we utilize third-party service providers to perform various functions, such as outsourced business-critical functions, professional services, SaaS platforms, cloud-based infrastructure, content delivery to third parties, and other functions. We engage reliable, reputable service providers that maintain cybersecurity programs and we conduct upfront cybersecurity reviews as part of our onboarding process for partners.


text: The Company reports on its information security program to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reports matters to the Board of Directors as needed. Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats to and security incidents relating to our information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and processes and controls supporting requirements with the General Data Protection Regulation (GDPR). We have an annual assessment performed by a third-party specialist of the our cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a Risk Mitigation Plan to mitigate such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Banzai International, Inc.

ticker: BNZI


text: In addition, we maintain policies over areas such as information security, incident management, business continuity, IT change and configuration management, acceptable use and access on/offboarding to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in our IT environment.


text: Our cybersecurity partners, including consultants, and other third-party service providers are a key part of our cybersecurity risk management strategy and infrastructure. These partners provide services including, but not limited to configuration management, penetration testing, network protection and monitoring, remote monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.


text: Our management team, in conjunction with the Chief Technology Officer and cybersecurity service providers are responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners. Management relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged for strategic cyber risk management, advisory and decision making.


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes vendor due diligence prior to onboarding, a review of System and Organization Control (SOC) reports on an annual basis, regular review of vendor contracts, and compliance with service level agreements (SLAs).


text: Our Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practical through changes or updates to our internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as the cybersecurity risk assessment process and developed an incident response plan. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Seritage Growth Properties

ticker: SRG


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of this process, we have elected to engage third-party managed service providers to maintain our network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our hosted services, all of the computer and computer-related hardware and software we use, and for managing our backup processes. Our primary managed service provider supplies management with weekly updates and activity reports related to network alerts, connectivity issues, and help desk tickets.


text: Tier 1. Access to critical infrastructure, data, or services affecting critical infrastructure. Administrative or privileged access to production systems, including hosting or developing systems, applications, websites, software, or SaaS solutions. Tier 2. Non-privileged access to Company applications.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Our management team has taken additional steps to implement our cybersecurity risk management program. For example, we have implemented periodic management reviews of our controls related to provisioning of user access to certain third-party hosted applications that we use in connection with the business and risks posed by certain critical vendors; this includes reviewing System and Organizational Control audit reports of such vendors. We maintain cybersecurity insurance coverage intended to mitigate our financial exposure to certain cybersecurity threats, and we consult with external advisors regarding opportunities and enhancements to strengthen our cybersecurity processes and practices.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function. In February 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Interim Chief Financial Officer or our Chief Legal Officer on our cybersecurity risks. In addition, our Interim Chief Financial Officer or our Chief Legal Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our information systems. Our entire Board will also receive briefings from our Interim Chief Financial Officer or Chief Legal Officer on our cybersecurity risk management program as part of our overall business risk updates.


text: Our management, represented by our Interim Chief Financial Officer, John Garilli, oversees the Company's cybersecurity risk management program. We have elected to engage third-party providers to maintain our network defenses and to manage and assess cybersecurity risk management and strategy for the Company. Our third-party providers update Mr. Garilli and other members of our executive management team with any network issues on a weekly basis and make recommendations for security upgrades as needed. The Interim Chief Financial Officer or the Chief Legal Officer will update the Audit Committee quarterly, or more frequently in the case of a significant cybersecurity incident impacting our information systems.


text: Risk Management and Strategy Our company is guided by a comprehensive cybersecurity framework to assess, identify, and manage material risks from cybersecurity threats. This framework is integrated into our overall quality and risk management system and is designed to protect our systems, data, and operations from cybersecurity threats. The framework includes policies to protect confidential information, guide periodic risk assessments, oversee and identify risks from cybersecurity threats associated with our use of third-party services providers, including through the use of a third-party risk management policy that accounts for such risks, and an incident response plan designed to detect, respond to, and recover from cyber incidents. Under this framework we may engage consultants and other third parties to assist in conducting cybersecurity risk assessments, implementing mitigation strategies, and testing the effectiveness of our cybersecurity controls.

companyName: VACCINEX, INC.

ticker: VCNX


text: There can be no guarantee that our policies and procedures will ultimately prove to be effective in every instance, especially considering evolving risk. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that these risks have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure related to cybersecurity risks, and our executive officers are responsible for the day-to-day assessment and management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function through the Audit Committee.


text: Our Chief Operating Officer and Systems Administrator are primary responsible for assessing and managing the cybersecurity risks we face under our policies and procedures, including those described in "Risk Management and Strategy" above. Our Chief Operating Officer is primarily responsible for reporting any material cybersecurity related incidents to our Audit Committee.


text: Risk Management, Governance and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.

companyName: OOMA INC

ticker: OOMA


text: Tier 3. No direct system access but may be associated through a partnership or have links hosted embedded within Company marketing material or websites.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.


text: We have implemented incident response and breach management processes. Notifications are made based on the level of threat of the incident. Incidents are evaluated to determine materiality as well as operational and business impact. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors.


text: Although the "Risk Factors" section includes further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date.


text: Although we continue to invest in cybersecurity and to enhance our internal controls and processes, we cannot guarantee these measures will be sufficient to protect us from a network security incident. For further information regarding the risks we face from cybersecurity threats refer to the "Risk Factors" within this Form 10-K.


text: Cybersecurity Risk Management and Strategy Our executive team and board of directors recognize that effective cybersecurity risk management is critical to the safety and security of our data, systems, and products and, ultimately, the long-term success of the Company. We have a comprehensive multi-layered cybersecurity risk assessment program, which covers the identification, analysis, evaluation, and management of cybersecurity risks. The program is cross-functional involving the participation and input of internal stakeholders, third-party consultants, and board oversight. The program is reviewed and updated on a semi-annual basis, or sooner if needed.


text: We engage in frequent and comprehensive monitoring of our systems, including network, systems, and application security monitoring integrated into a Security Information and Event Monitoring (SIEM) system. In addition, should a cybersecurity incident occur, our response plan is based on the NIST Special Publication 800-61 Revision 2 Computer Security Incident Handling Guide, and requires the following steps:


text: Discovery. Occurs when a potential security incident is reported. Discovery can be initiated in several ways, including by customer support, employees, business partners, as a result of IT logging and monitoring, or in response to customer or vendor correspondence. Containment is the priority in the Discovery phase.


text: Investigation. Occurs when the Discovery phase establishes a likelihood that the event is an actionable security incident that warrants further research and analysis. In the Investigation phase, the priority is to swiftly complete an accurate, thorough investigation of the security incident.


text: Response. Occurs when a security incident is a confirmed data breach; when a security incident requires the Company to take further action to protect the organization and/or affected parties whose sensitive personal information is at risk or has been compromised; or when additional administrative, physical, or technical controls are needed after a security incident. In the Response phase, the priority is to swiftly complete required notification and other procedures according to applicable law.


text: Closure. Occurs when the Company's incident response steering committee can review the security incident and actions taken to evaluate whether proper investigation and documentation have occurred, and the matter requires no further notice or containment. Root causes and steps to prevent future incidents have been identified.


text: In the Closure phase, the priority is to confirm that all necessary containment, investigation, and response tasks have been completed.


text: Review. Occurs after the event has been resolved. The priority in this phase is to review the investigation/response process and update this Plan based on the lessons learned.


text: We also have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third party service providers. We classify third parties engaged by us based on risk and impact to our business. Classification is broken into tiers as follows:


text: Third party risk scores are weighted based on the classification tier and monitored over the course of the year. A change in risk score may trigger an audit for the third party as well as a remediation plan to address any identified gaps, which our information security team oversees in conjunction with the relevant business owner for the third party relationship.


text: While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, account takeover, fraudulent order, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition, and we do not believe such risks are reasonably likely to have such an effect over the long term. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - Our reputation and business may be harmed if our or our vendors' computer network security or any of the databases containing customer, employee, or other personal information maintained by us or our third-party providers is compromised, which could materially adversely affect our results of operations."


text: Cybersecurity Governance Our board of directors has ultimate oversight of our risk management policies and strategies. Our executive team, which is responsible for our day-to-day overall risk management practices, present to the board of directors on the various material risks to our Company, including risks related to information technology and cybersecurity.


text: The audit committee has formal oversight responsibility for cybersecurity, as delegated by our board of directors, and is responsible for reviewing our policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, our Chief Administrative Officer, Chief Technology Officer ("CTO"), and/or Chief Information Security Officer ("CISO") provide semi-annual updates to the audit committee with respect to cybersecurity incidents, mitigation, threats, risks, and management, which are also communicated to the full board.


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience at the Company and elsewhere, is responsible for developing and overseeing matters related to cybersecurity and reports directly to our CTO, who is accountable for the overall information technology and security strategy of the Company. The CISO receives reports on cybersecurity threats from several experienced information security professionals responsible for various parts of the business on an ongoing basis and, in conjunction with our enterprise risk steering committee, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO works closely with our legal department to oversee compliance with legal, regulatory and contractual security requirements. Our enterprise risk steering committee is comprised of key stakeholders throughout the Company and works with management and our CISO to (i) identify and review certain cybersecurity risks that we face, including the probability and impact of such risks, and (ii) identify steps needed to eliminate or mitigate such risks. In addition, we have a well-defined cybersecurity incident response plan, as described above. Finally, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the audit committee and the board of directors.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a data security incident response policy and a security incident response plan, which were first developed in 2017 and are periodically reviewed and updated.

companyName: LANDS' END, INC.

ticker: LE


text: We have designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, rather only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to our legal, compliance, strategic, operational, and financial risk areas.


text: Our Information Security Department and Security Management functions, led by our Chief Information Officer ("CIO") and supported by our Director of Information Security and Compliance, (collectively, "Security Team"), help identify, assess and manage the Company's cybersecurity threats and risks. The Security Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools in certain environments and systems, internal and external audits of certain environments and systems, conducting scans of certain threat environments, evaluating our and our industry's risk profile, analyzing certain reports of threats and actors, conducting threat assessments for internal and external threats (including third party threat assessments) in certain environments, coordinating with law enforcement concerning select threats, subscribing to reports and services that identify cybersecurity threats, use of external intelligence feeds, conducting tabletop incident response exercises, evaluating certain threats reported to us, and conducting vulnerability assessments of certain environments and systems..

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Our cybersecurity risk management program includes: • a data security incident response policy and a security incident response plan that include detailed procedures for responding to cybersecurity incidents, determining severity of cybersecurity incidents and notifying appropriate internal and external parties; • third-party and internal risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team consisting of members of our information technology department, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • periodic tabletop exercises involving the security team, the data security incident management team, and members of management, with special sessions expected to occur for the Board of Directors; • annual audit by a Payment Card Industry ("PCI") qualified security risk assessor to validate our PCI compliance; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • regular cybersecurity awareness training, including social engineering and phishing testing of our employees, incident response personnel, and senior management; • deployment of external tools designed to detect and protect against spam, malware and other cybersecurity threats and train personnel; and • third-party security event monitoring.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be adequate, fully complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – RISKS RELATED TO INFORMATION TECHNOLOGY, CYBERSECURITY AND DATA PRIVACY."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of data protection and cybersecurity risks as part of the Audit Committee's oversight of the Company's enterprise risk management framework. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity.


text: The Audit Committee receives regular reports from management on our cybersecurity risks, which include updates on trends and threats, the Company's backup and response systems, internal and external risk assessments, results of PCI and other security audits, and planned updates and upgrades. The Audit Committee also receives regular enterprise risk management updates, which include management of cybersecurity risks.


text: In accordance with our data security incident response plan, management is required to promptly update and discuss with the Audit Committee any material or potentially material cybersecurity incidents and provide an update to the Board upon determination. Management regularly updates the Audit Committee regarding incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, Chief Technology Officer and General Counsel (the cybersecurity disclosure committee), is responsible for assessing material risks from cybersecurity threats and our General Counsel oversees any required reporting obligations and notifications. Our Chief Technology Officer has primary responsibility for overseeing our security incident response plan, including identification and initial assessment of threat levels and escalations. Critical incidents are escalated to a cross functional data security incident management team for review, which then escalates potentially material incidents and threats to the cybersecurity disclosure committee for determinations of materiality and Audit Committee and Board communications. Our Chief Technology Officer has 20 years of experience with cybersecurity management response, and multiple direct reports who have 10 or more years of experience leading technology infrastructure and security incident response. Our General Counsel has over seven years of experience leading our incident response management team.


text: Our Chief Technology Officer is the primary point of responsibility for cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our customers and employees.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident response policy, vulnerability management policy, risk assessments, encryption of certain data, network security controls and data segregation for certain environments and systems, access controls for certain environments and systems (such as identity controls and quarterly user access reviews), physical security, systems monitoring for certain systems, vendor risk management program, system configuration standards, employee security awareness training, asset management, managed detection and response tools, penetration testing, cybersecurity insurance and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Security Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, for example: professional service firms including legal counsel, threat intelligence service providers, cybersecurity consultants, 24/7 cybersecurity monitoring software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services and forensic investigators, managed detection and response providers, and external threat hunting partners.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and application providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment and security questionnaire for certain providers, review of security assessments for certain providers, and System and Organization Controls report reviews when determined necessary. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and our Director of Information Security and Compliance, who has over 20 years of experience in the information technology industry and is a Certified Information Systems Security Professional (CISSP).


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO, Director of Information Security and Compliance and the CFO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the CIO, the Chief Executive Officer and others. These individuals work with the Company's incident response team, pursuant to a documented incident response plan, to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the Security Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Maintaining the safety and security of our systems and data is essential to the success of our company. As with other industries, there are several cybersecurity threats we encounter. These include phishing, ransomware, and denial of service, among others. Our suppliers, vendors, and other partners face similar threats. A cybersecurity incident impacting us or any of these entities could materially affect our operations, performance, or financial results. See Item 1A, Risks Related to Information Security for additional details.

companyName: J.Jill, Inc.

ticker: JILL


text: The governance of our risk management program is a partnership between our cross functional management team and our Board of Directors. This program includes both a cyber team led by our Chief Information Officer ("CIO"), as well as an Enterprise Risk Management ("ERM") program led by our head of compliance. Our CIO has 30 years of information technology experience, including over 3 years of direct oversight of information security. Risk oversight for both our cyber and ERM programs is primarily the responsibility of the Audit Committee of the Board of Directors who receive quarterly updates, at a minimum, with additional updates shared to the full Board of Directors on a recurring basis.


text: Cyber Security Team Our cross functional cyber security team is responsible for the overall information security strategy, risk assessment, cyber threat detection and response, and execution of an ongoing cyber program. The goal of this team is to lower the impact and likelihood of persistent threats to the extent feasible, including safeguarding of key information and the integrity of key systems. We also partner with third-party vendors to enhance our program including monitoring, pen testing, and other assessments and programs. Additionally, the Company has implemented certain information security measures which include security reviews as well as internal training and testing programs.


text: Enterprise Risk Management (ERM) Program Our cyber risks are included in our ERM program. Our ERM program is led by our Senior Director of Compliance and Internal Audit and has oversight from our Audit Committee. This program includes a cross functional team including our senior leadership team and other key members of management. Risk reduction plans are developed and updates are regularly assessed by the team. Our Audit Committee provides oversight and is briefed quarterly, at a minimum. In the event a cyber incident should occur, there are additional steps taken to mitigate cybersecurity risks and incidents.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.


text: Risk Management Approach and Strategy Our corporate information technology, accounting and financial reporting platforms, and related systems (our "Information Systems") are necessary for our business. We use these systems, among others, to manage key aspects of our business, including relationships with our tenants and vendors, accounting, acquisitions, internal and external communications and property and asset management. We also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data related to our business (our "Sensitive Data"). We engage a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our cybersecurity risk management is integrated into our overall enterprise risk management efforts and shares common methodologies, reporting channels and governance processes that apply across our overall enterprise risk management.

companyName: GENERATION INCOME PROPERTIES, INC.

ticker: GIPR


text: We and our MSP identify, assess and manage material cybersecurity threats and risks to our Information Systems and Sensitive Data through the following, among others: • a multidisciplinary team, including a dedicated technology committee (the "Technology Committee") comprising members from senior management, asset management and accounting and legal functions, in conjunction with our MSP and other third-party service vendors, to identify, assess and manage cybersecurity threats and risks; • various internal processes and procedures to monitor and evaluate threat environment and our risk profile using methods such as manual and automated tools, subscribing to reports and services that identify and analyze cybersecurity threats, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments; • various technical, physical and organizational processes and policies to manage and mitigate material cybersecurity risks, such as risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training and penetration testing; and • working with third-party vendors from time to time that assist us to identify, assess and manage cybersecurity risks, such as professional services firms and penetration testing firms.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools to allow security researchers to assist us in identifying vulnerabilities in our environment before they are exploited by malicious threat actors. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. Depending on the environment, we implement and maintain various processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information system and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training, and penetration testing.

companyName: Surrozen, Inc./DE

ticker: SRZN