text: With respect to overseeing and identifying cybersecurity risks associated with third parties, we seek to impose certain cybersecurity requirements on critical third parties with whom we do business. The cybersecurity team performs risk assessments, due diligence checks and validation of key security controls in accordance with our cybersecurity policies and standards for third-party vendors and service providers with whom we exchange information or integrate our information systems and networks. We include cybersecurity and privacy addenda and clauses in our agreements with such third parties where applicable and seek to pass through any necessary regulatory and contractual requirements to such third parties. When we do become aware that a third-party vendor or service provider has experienced a compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate or by exercising any applicable contractual remedies we may have, such as a right to indemnification.


text: On a semi-annual basis the cybersecurity team conducts a program performance evaluation with management to assess the continuing suitability, adequacy and effectiveness of the Company's cybersecurity risk management program, including with respect to the fulfillment of cybersecurity objectives and compliance with industry standards, and to recommend changes to the Company's threat modeling, priorities for future risk assessments, policy adjustments in response to newly identified risks or non-compliance, and overall risk acceptance.

companyName: Mobileye Global Inc.

ticker: MBLY

secItem: Item 1C


text: To foster a culture of cybersecurity awareness within the Company and provide employees with further knowledge of cybersecurity-conscious behavior, all employees of the Company are required to attend cybersecurity training sessions during the onboarding process and at least once per year.


text: Our cybersecurity team, which is led by our Digital Information & Cybersecurity Officer (DISO), implements and maintains our cybersecurity risk management program and is dedicated to mitigating risks and protecting the confidentiality, integrity, and availability of our systems and data. Our cybersecurity team's functions include security operations, vulnerability management, security engineering and architecture, compliance and audit support, threat intelligence, security awareness training, and policy development. Our cybersecurity team is also responsible for developing and executing the incident response plan.

companyName: Waystar Holding Corp.

ticker: WAY

stage1Category: Risk Management Process

stage1Method: majority


text: Our organizational cybersecurity program is under the direction of our Chief Information Security Officer ("CISO") who receives reports from our cybersecurity team and oversees the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. Our CISO reports to our Chief Operating Officer ("COO"), who may discuss cybersecurity risks and other operational risks with other senior management as appropriate. Our CISO and dedicated cybersecurity team personnel are certified and experienced information systems security professionals and cybersecurity managers with many years of experience. Our CISO has served in that position since 2019 and has over 25 years of managerial and professional cybersecurity expertise. He has held the role of CISO and other senior management positions with NDS, Cisco and Deloitte and has also served as cybersecurity consultant for companies in multiple global industries. Our COO has extensive experience in project management and cybersecurity, including from past roles with Verint - Systems and Cisco Systems as well as the establishment and management of the Company's cybersecurity team prior to our CISO joining the Company.

stage1Category: Management Role

stage1Method: unanimous


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. The Company's cybersecurity team regularly meets with the COO to report its findings. The COO in turn periodically reports on such matters to the Chief Executive Officer and other members of management.


text: The COO and CISO provide updates to the audit committee of our board of directors (the "Audit Committee") on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies. In addition to such regular updates, and as part of our incident response processes, our COO is also responsible for informing the Audit Committee of material cybersecurity threats and incidents, based on management's assessment of risk.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks and mitigate and remediate cybersecurity threats and incidents. Both management and the Audit Committee also report material cybersecurity risks to our full board of directors, based on management's assessment of risk.


text: In 2024, we did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Privacy, Data, and Cybersecurity" in this Annual Report on Form 10-K.

stage1Category: Strategy Integration


text: Cybersecurity Risk Management and Strategy We have developed a cybersecurity risk management program to regularly assess risks from cybersecurity threats and monitor our systems to manage those risks. Our cybersecurity risk management program is an important component of, and integrated with, our overall enterprise risk management framework, which addresses legal, compliance, operational, and financial risks, alongside cybersecurity risks. Through this integration, we aim to optimize resource allocation, improve risk identification, and strengthen our cybersecurity governance.


text: Our cybersecurity risk management program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) and is aimed to assess, identify, and manage risks from cybersecurity threats. The processes comprising our cybersecurity risk management program include risk assessments, vulnerability scanning and penetration testing, threat intelligence monitoring, and employee training and awareness programs. To respond to and handle cybersecurity incidents, we have implemented and maintain a comprehensive incident response process that is regularly tested and updated.


text: To protect our information systems from cybersecurity threats, we employ technical processes as a crucial component of our multi-layered cybersecurity risk management program. These processes include firewalls, intrusion detection and prevention systems, access controls, endpoint protection, data encryption, vulnerability management, security information event management, data loss prevention, regular security assessments, and penetration testing. Our technical processes are regularly reviewed and updated.


text: As part of our cybersecurity risk management program, we undergo regular assessments and audits by external and independent auditors. These include assessments following the Health Information Trust Alliance (HITRUST) Common Security Framework. We also undergo independent System and Organization Controls 2 (SOC 2) Type 2 audits and assessments to validate compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirements. We carry a HITRUST certification and PCI certification. The results of these audits and assessments are reported to our Board of Directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary or appropriate based on the information provided by these assessments and audits.


text: Cybersecurity Governance Our Board of Directors is aware of the critical nature of managing the risks associated with cybersecurity threats. The Board of Directors has established oversight mechanisms to ensure effective governance in managing these risks.

companyName: INNODATA INC

ticker: INOD


text: Because we rely on third-party vendors, including for information technology services, we have processes to oversee and identify risks from cybersecurity threats associated with our third-party vendors. These processes include vendor screening and due diligence, contractual requirements, security assessments and audits, incident response planning requirements, and ongoing monitoring.

stage1Category: Third-Party Risk


text: We are not aware of any risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. As discussed more fully under Item 1A "Risk Factors," there is a risk that we could experience a security incident and a compromise of our information technology systems and data. There is no assurance that our cybersecurity program will in all cases prevent such security incidents. We also maintain cybersecurity insurance that we regularly review to assess for appropriate coverage.


text: Role of the Board Our Board of Directors plays an active role in overseeing our cybersecurity risk management program. The Board of Directors or the Audit, Compliance, and Risk Committee receives a quarterly update on cybersecurity-related topics. The Board of Directors receives materials every quarter and presentations on alternating quarters from our Chief Technology Officer (CTO) on topics including significant cyberattacks and emerging threats, cybersecurity program performance, results of risk assessments, incident response updates, cybersecurity strategy, and cybersecurity program maturity. We have also established procedures for promptly informing the Board of Directors of any material cybersecurity incidents outside of these scheduled briefings.

stage1Category: Board Governance


text: Role of Management Our DISO is responsible for developing and implementing our cybersecurity program and holds certifications including ISO/IEC 27001:2002 Certified Information Security Executive, Cyber Security Executive Certification from Cornell University, Risk & Compliance Executive Certification from William & Mary University, and Healthcare Risk & Compliance Certification from American College of Medical Practice Executives (ACMPE). Our DISO's responsibilities include managing cybersecurity risk, leading the cybersecurity team, staying informed about threats, reporting on cybersecurity performance, promoting a culture of security, and compliance and audit support. Our DISO regularly updates senior management and the Board of Directors on the performance of the cybersecurity program and the state of cybersecurity risk. Our DISO reports directly to our CTO who provides executive leadership and support for the overall technology and cybersecurity strategy.


text: To promote strong governance and oversight in managing cybersecurity risk, we have established a Cyber Risk Council, which is composed of our CTO, DISO, Chief Privacy Officer, Chief Financial Officer, Chief Legal & Administrative Officer, and representatives of our technology and cybersecurity teams. The Cyber Risk Council is responsible for overseeing cybersecurity risk, monitoring performance of the cybersecurity risk management program, providing strategic guidance, and direction of the cybersecurity risk management program, among other oversight and monitoring functions.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Concord Acquisition Corp II

ticker: CNDA


text: Risk management is an essential component of our culture and business model. Guarding against the specific risks posed by cybersecurity threats has been and will continue to be very dynamic in nature, requiring that we remain agile and aware of internal and external changes. We recognize that cybersecurity threats can be among the most critical risks facing large companies. As a result, cybersecurity is treated as a Board-level matter and overseen by the Board. However, both the Board and management have an integral role in the identification, assessment and management of cybersecurity risk.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The Board oversees management's execution and performance of its risk management responsibilities, which includes cybersecurity threats. The Board receives at least one cybersecurity report every quarter from our Chief Information Officer, our Chief Information Security Officer, our Chief Risk Officer or other professionals. The Board also reviews and approves the business resiliency and information security programs intended to guard against cybersecurity and related risks. Lastly, the Board receives input on cybersecurity issues from external entities such as our independent auditor, regulators and consultants. Each of these steps further the Board's efforts to ensure we have established and are proactively maintaining an enterprise-wide cybersecurity risk program with appropriate policies, practices and controls designed to ensure resiliency in the face of emerging threats.


text: Management holds relevant expertise in assessing and managing cybersecurity threats. Numerous members of management and employees across the information security and risk functions hold nationally recognized designations and certifications, including the Certified Information Systems Security Professional designation, Global Information Assurance Certifications and Amazon Web Services Cloud Certifications. We also provide role-based security training to workers with assigned information security-related roles and responsibilities. This includes topics on social engineering tactics and other general threats posed for system compromise and data loss. The initiatives and processes discussed further below also contribute to the expertise and experience of management.


text: The framework for our overall process for managing risk encompasses the management of risks posed by cybersecurity threats. Management's role, responsibilities and processes for identifying, assessing, monitoring, reporting and managing risks, which includes cybersecurity risks, is discussed further in Item 1. "Business — Risk Management." As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization.


text: We test for and resolve vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing and adversary emulation, also known as red teaming and hire a third party to do the same at least once a year. We maintain a vulnerability disclosure program to enhance discovery and remediation of external-facing vulnerabilities. We also undergo a third party maturity assessment of our information security program every two years and a third party enterprise penetration test annually. We leverage external resources to help define information security and technology standards for our environment.


text: Our cybersecurity controls are monitored and refined based on learnings from regular red team engagements and analysis by third party threat hunters. All cyber defense operations are supported through a dedicated cybersecurity threat intelligence function. We collaborate with information security peers across the industry to augment threat intelligence. Our threat intelligence program helps create awareness and understanding of potential cybersecurity threats and adversaries.


text: We proactively assess potential risks presented by new services or systems integrated with our network or data and ensure appropriate controls are applied under such circumstances. We have proactive security controls built into our software development life cycle that help engineers identify and resolve security issues at every stage of software development. Our identity verification processes, which include multi-factor authentication and other identity verification technologies, provide further protection for clients and customers. We perform due diligence and monitor third party relationships to assess the suitability of their cybersecurity controls and protocols based on risk profile for the business operations or services for which they are engaged.


text: Our awareness and training program is designed to create a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have trained our employees to recognize and resist phishing attempts with our simulated phishing program. At least quarterly, our employees are presented with simulated phishing scenarios that deliver hands-on experience and on-the-spot education opportunities. All engineers and employees holding equivalent roles who are involved in software development also receive mandated secure software development training.


text: We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise. The plan ensures stakeholders across the organization are identified who have the appropriate experience, training and expertise in incident management and that the organization is well positioned to address incidents. For example, we carry out cybersecurity incident response exercises to develop widespread familiarity and experience in responding to cybersecurity incidents.


text: No risks from any known cybersecurity incidents have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion related to how cybersecurity risks may impact our performance in the future, see Item 1A. "Risk Factors."


text: As we have positioned ourselves as a public company acquisition vehicle, and have limited operations, we do not have any significant operations that face cybersecurity threats. Although we do depend on the digital technologies of third parties, and any deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, information and sensitive or confidential data, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Viskase Holdings, Inc.

ticker: ENZN


text: We are a special purpose acquisition company with no business operations. Since inception, our sole business activity has been to complete the Proposed Offering. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: FG Merger II Corp.

ticker: FGMC


text: To enhance our current cybersecurity posture, we continue to invest in advanced threat detection technologies, provide cybersecurity training based on the latest trends and guidance to the employees, collaborate with industry partners and regulatory bodies to stay informed about emerging threats, reinforce our cybersecurity incident response plan to align with industry-specific regulations and legal obligations, integrate threat intelligence feeds for automatic detection of any misconfigurations, security threats, and foster a collaborative, cross-functional, and accelerated approach to incident response.


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our inception


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing and maintaining a firm cybersecurity posture to safeguard our information systems, protect the confidentiality, integrity and availability of our data and mitigate risks associated with cyber threats and attacks.


text: We are ISO/IEC 27001:2022 certified and the ISO Information Security Risk Management Standard is used as a reference guide for our risk management approach. We have a designated Chief Information Security Officer (CISO) who has primary responsibility for managing our cybersecurity risks. Our CISO has more than 28 years of experience in Information Security and holds a master's degree in Information Technology. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO is assisted by a team of Information Security Officers (ISOs) and a third-party consultant who has expertise in cybersecurity, information security risk management, and information systems audit and holds various certifications including, CISA, CISM, HITRUST Certified Common Security Framework Practitioner, QSA, and CSP.


text: Recognizing the inherent cybersecurity risks common to any organization, encompassing concerns such as unauthorized access to sensitive data, potential disruptions to business operations from cyber incidents, and the associated financial and reputational impacts arising from a cybersecurity breach, we have implemented comprehensive policies covering various aspects of cybersecurity and information management, including, without limitation, cyber risk management, information security practices, roles and responsibilities, access controls, cryptography, information classification, asset disposal, and vendor management. We periodically review and modify these policies to align with industry practice, trends and evolving threat landscapes. Compliance with these policies is expected from all employees and contractors.


text: We perform periodic assessments for identifying threats and vulnerabilities, covering relevant operational facets, and focusing on identifying, analyzing, evaluating, and treating cyber risks across business functions. Our risk assessment guidelines define risk measurement and prioritization, and consider factors such as likelihood, impact, and potential harm. Mitigation strategies are planned, covering technical and procedural measures, including incident response plans.


text: Incident Response We maintain a comprehensive incident response plan. Key components include regular updates to ensure effectiveness, employee training programs, and establishing communication channels and relevant systems for proper incident reporting and logging procedures. Communication and notification protocols are defined for notifying third parties such as regulatory bodies, customers, and partners. Recovery strategies are developed for restoring normal operations, and post-incident analysis is conducted to identify lessons learned and improvements for future incident response efforts. The incident response plan also outlines procedures for prompt detection, response, and remediation efforts to minimize the impact of incidents.


text: Incident materiality is assessed through a collaborative process involving key personnel within our organization. Responsibility for conducting a materiality assessment lies with our management team, in consultation with advice from our third-party cybersecurity consultant, as appropriate. The materiality assessment considers various factors, including financial impact, reputational risk, regulatory implications, and potential harm to third parties. Upon completion of the materiality assessment, the disclosure of incidents, including those related to contractual, regulatory, or technology/security aspects, is handled by designated members of our senior management team. We consult with outside counsel or experts as appropriate, including on materiality analysis and disclosure matters.


text: As of the fiscal year ending December 31, 2024, there have been no identified cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Engagement of Third Parties Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged a third-party consultant to assist with evaluating and testing our risk management approach. This enables us to leverage specialized knowledge and insights in connection with our cybersecurity strategies and processes.


text: Board of Director Oversight Our Audit Committee has primary responsibility for overseeing risk management, including with respect to cybersecurity. The Audit Committee monitors management's compliance, and reports to the Board of Directors. The CISO, who is responsible for developing our cybersecurity strategy and managing our cybersecurity risks, reports directly to the Audit Committee on these matters.


text: Management's Role Our cybersecurity governance framework incorporates policies, procedures, regular meetings, and controls to manage and mitigate cybersecurity risks. Aligned with industry standards and regulatory requirements, the framework is overseen and regularly evaluated by our leadership team responsible for implementation. Regular risk assessments are conducted to identify and assess potential cybersecurity risks, informing the development of proactive risk mitigation strategies within the governance framework.


text: The governance framework is closely integrated via a structured compliance reporting framework operating across various governance levels. This framework also operates across geographic locations, with location specific compliance meetings conducted at a local management level and led by the CISO with assistance from the ISO team. This structured compliance reporting is intended to ensure that the highest levels of management are kept abreast of potential cybersecurity risks facing the Company, with the escalation of significant cybersecurity matters to the Audit Committee and ultimately to the Board of Directors, as appropriate.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We design and assess our program generally based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). Although our program may not meet the technical requirements of the NIST CSF, we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Additionally, as we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards ("PCI DSS") in relation to our program.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment, including, by regularly scanning our environment for vulnerabilities, performing penetration testing and engaging third parties to assess the effectiveness of our technical cybersecurity practices;


text: a multi-disciplinary security team overseen by our Information Security Council, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis;


text: the use of a third-party Managed Security Service Provider ("MSSP") that includes a 24x7 security operations center ("SOC") that is designed to monitor and analyze suspected suspicious activity on our internal network and remediate or escalate activity as appropriate; regular cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;


text: use of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Detection and Intrusion Prevention (IDS/IPS) that scans data in transit to help detect and prevent the execution of harmful code; and a third-party risk management process for service providers, suppliers, and vendors who have access to our information systems.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or are effective in protecting our systems and information. We are not currently aware of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: a dedicated security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; cybersecurity controls to detect cybersecurity incidents or risks within our IT Systems;

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of steps the Company has taken to monitor or mitigate significant cybersecurity risks. The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from our Chief Information Officer ("CIO"), internal security staff and/or external experts, as appropriate, as part of the Board of Directors' continuing education.


text: Our management formed an interdepartmental Information Security Council ("ISC"), comprised of senior executives from multiple disciplines, including our CIO and Vice President of Infrastructure Services, to assess and manage our material risks from cybersecurity threats. The ISC has primary responsibility for our overall cybersecurity risk management program. Our CIO, Vice President of Infrastructure Services, and others within our Information Technology department supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and Vice President of Infrastructure Services have a combined 50+ years of experience in information technology, with increasing oversight of cybersecurity responsibilities over the past 20+ years.


text: Our management teams, including the ISC, our CIO, Vice President of Infrastructure Services, and others within our Information Technology department, as appropriate, supervise efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy To effectively prevent, detect and respond to cybersecurity threats, we maintain a cyber risk management program under the responsibility of the head of the Information Technology ("IT") function. Our IT head has more than 25 years of IT experience in the biopharmaceutical industry where she has been responsible for technology leadership and digital transformation across core operations. Management and administration of cybersecurity systems and activities are primarily outsourced to consultants who have cross-functional expertise in cyber security and who perform the work under the supervision of the IT head. Our IT head, in turn reports to the Senior Vice-President and General Counsel who is responsible for and knowledgeable of legal and contractual cybersecurity risk for the organization. The program is comprised of policies, standards, architecture, and processes, which are reviewed and updated on a periodic basis. The program leverages a multilayered approach of utilizing different practices, technologies, vendors or techniques without an overreliance on a single vendor. We engage with consultants to help develop and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements, and also evaluate and adopt cybersecurity software from reputable vendors in cybersecurity, some that provide software as a service solutions backed by a Security Operations Center. We also engage separate third parties to provide penetration testing, risk consulting, cybersecurity incident assessment and forensics, as necessary and in addition to IT's internal risk assessment processes. We work with many companies that provide hosted software or support for software systems. It is important for these companies to also have effective cybersecurity measures to protect data and systems. We have a self-attestation form to assess cybersecurity readiness that is sent to select vendors based on a risk assessment. For certain vendors, we request System and Organization Controls (SOC) reports or similar documents to provide assurance that the vendors have audited practices or practices in keeping with our legal requirements even if SOC audit documentation does not exist. We have also engaged legal counsel to advise on cybersecurity matters and we have developed an escalation protocol to report cybersecurity incidents as legally required. No material cybersecurity incidents have occurred to date.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX


text: The program also includes training that reinforces our policies, standards, and practices, as well as the expectation that employees comply with these policies. The training engages personnel on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests. We maintain a cybersecurity risk insurance policy.


text: Governance; Board Oversight Our Audit Committee is responsible for reviewing our information security programs, including cybersecurity. Our IT team provides regular updates to the Audit Committee on our IT security strategy, secure score assessments, penetration testing results, and status of risk mitigation activities, where applicable. Our IT team also notifies the Audit Committee and Executive Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities, as appropriate.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the Center for Internet Security (CIS) control objectives and benchmarks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS objectives and benchmarks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: cybersecurity awareness training and communications for employees;


text: internal and external risk assessments designed to help identify material cybersecurity risks to our critical systems and information; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our network may be the target of potential cyber-attacks and other security breaches that could have significant negative consequences."


text: The Audit Committee of our Board of Directors is tasked with oversight of the Company network and data security efforts and is responsible for the Company's policies and practices with respect to cybersecurity and enterprise risk management. We have a dedicated Cybersecurity Operations Team in our Information Technology department which reports directly to the CIO. The Cybersecurity Operations Team is primarily responsible for evaluating our security efforts and coordinating with our CIO and other management employees as necessary. The CIO meets with our Audit Committee regularly to update the Audit Committee on any new or identified cybersecurity threats, the Company's cybersecurity efforts and plans for the upcoming quarters. Our Audit Committee also meets regularly with senior management, including our CIO, to receive updates and about the Company's cybersecurity initiatives.


text: Our CEO regularly meets with our CIO to discuss, in part, any significant cybersecurity issues. In addition to the CIO, our Cybersecurity Team and the Information Technology Team are responsible for the day-to-day monitoring of the cybersecurity landscape, the Company's monitoring and response processes and training of Company employees. The Chief Legal Officer, Vice President of Network Strategy and VP of Network Engineering may also be involved, as necessary.


text: Our CIO's experience includes over twenty years of experience in risk management and compliance, incident response, crisis management and security architecture and technology integration. Our Cybersecurity Operations Team includes three certified information systems security professionals and their experience includes cybersecurity architecture, engineering and administration together with the development of cybersecurity policies, practices and training.


text: In general, cybersecurity incidents can result from deliberate attacks or unintentional events such as a cyber-attack against USCF, a natural catastrophe, an industrial accident, failure of the Trust's disaster recovery systems, or consequential employee error. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of a fund's clearing broker or third party service provider (including, but not limited to, index providers, the administrator and transfer agent, the custodian), have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of fund shareholders to transact business, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: The Trust does not have computer systems or networks. Pursuant to the terms of the Trust Agreement, the Trust's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on the Trust, USCI and CPER. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. USCF engages a third-party consultant and service provider to assist with information technology services and advise on USCF's information technology infrastructure. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and the Trust.


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Trust Series, including its business strategy, results of operations, or financial condition.


text: This cross-functional team possesses a comprehensive understanding of cybersecurity, data privacy, and risk management, essential in developing, monitoring, and enforcing our cybersecurity strategy.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: The Director of Compliance, as identified below, provides regular reports to USCF's Board of Directors on developments to the information security and cybersecurity risks facing the Trust. Reports may include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to the Trust.


text: In general, cybersecurity incidents can result from deliberate attacks or unintentional events such as a cyber-attack against USCF, a natural catastrophe, an industrial accident, failure of USL's disaster recovery systems, or consequential employee error. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of a fund's clearing broker or third party service provider (including, but not limited to, index providers, the administrator and transfer agent, the custodian), have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of fund shareholders to transact business, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: USL does not have computer systems or networks. Pursuant to the terms of the LP Agreement, USL's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on USL. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. USCF engages a third-party consultant and service provider to assist with information technology services and advise on USCF's information technology infrastructure. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and USL.


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is no t aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect USL, including its business strategy, results of operations, or financial condition.


text: The Director of Compliance, as identified below, provides regular reports to USCF's Board of Directors on developments to the information security and cybersecurity risks facing USL. Reports may include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, and management's evaluation of cybersecurity risks material to USL.


text: As a heavily regulated financial services company, the Company has developed a comprehensive cybersecurity process that is designed to protect the security of confidential information. Two of the more significant risks to the Company, both in terms of financial and reputational harm, are a data security breach and/or ransomware attack which cause a material financial loss to the Company and/or materially harms its operational integrity or reputation with its customers as a safe and trustworthy institution. In order to mitigate this risk and comply with the regulatory standards required by the Company's and the Bank's regulators, the Company has developed a cybersecurity program and framework which is administered by a team of experienced professionals and supported by external technology and consulting services. Set forth below is an overview of the Company's risks associated with cybersecurity, its cybersecurity process, the role of management and the Board, and whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Risks Associated with Cybersecurity The Company is often targeted in an effort to obtain unauthorized access to its financial records and confidential information, destroy data, disable or degrade service, or sabotage systems. Such attacks may take various forms, including the introduction of computer viruses or malware, ransomware, phishing attacks, cyberattacks, or breaches due to errors or malfeasance by employees, contractors and others who have access to or obtain unauthorized access to the Company's systems and networks. To date, these threats and attacks have not resulted in a material cybersecurity incident. However, a material failure, interruption or security breach could adversely affect the Company's business and operations through financial losses, remediation expenses, reputational damage, as well as exposing the Company to customer dissatisfaction and civil litigation, regulatory fines or penalties or losses not covered by insurance. For more information on risks to the Company from cybersecurity threats, see "Risk Factors – Operational Risks".


text: Cybersecurity Process and Management's Role Management is responsible for designing and implementing policies, processes and procedures and deploying physical and virtual technology and safeguards to measure, monitor and control cybersecurity risk. The primary executives responsible for the oversight of risk and cybersecurity are the Company's Chief Risk Officer, who has over 37 years of experience in the banking industry, including 25 years as a national bank examiner for the Office of the Comptroller of the Currency, and the Company's Chief Information Security Officer ("CISO"), who has an educational and experiential background in information technology and information security for public companies (bachelor's degree in computer science and service as the Company's CISO for the past 10 years, with 10 prior years of information technology and information security experience). The CISO leads the members of the Information Security Department, some of whom maintain a variety of certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Security+ (Plus) Certification (SEC+). Both of these executives, along with the other professionals in the Information Security and Information Technology Departments, have the appropriate knowledge and expertise to effectively assess and manage the Company's cybersecurity risk and establish a system of internal controls in an effort to safeguard the Company's network and comply with regulatory requirements.


text: The Company's cybersecurity framework includes an assessment of the Company's hardware, software, and data platforms across its lines of business; the risks associated with the Company's business; areas inside and outside of the Company that expose it to cybersecurity threats. As part of this framework, the Company employs policies, systems and safeguards to manage cybersecurity risks. The Company's CISO is responsible for identifying systems and security measures that reflect the appropriate safeguards designed to protect the Company's infrastructure and information and has implemented the majority of current cybersecurity controls in place with an emphasis on the confidentiality, integrity and availability (CIA) triad and a defense in depth methodology. The CISO uses a variety of threat intelligence resources, including law enforcement and industry groups such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), to help stay informed about current and emerging risks to the Company.


text: The CISO is also responsible for supervising and monitoring certain outside professionals or third-party service providers that assist in enhancing the Company's current cybersecurity safeguards. The Company has invested meaningful resources to address cybersecurity threats and partners with leading technology companies to implement solutions to address the fast-evolving threat landscape. These solutions and services help with the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.


text: The Company's Internal Audit Department further assists the Company to ensure that the proper safeguards are in place to protect the Company's information by conducting internal audits on certain aspects of the information security program. Internal Audit engages professionals that specialize in information security to review and provide an annual examination and report on the sufficiency of the Company's cybersecurity process and information security program. The Company's independent public accounting firm also performs audit procedures regarding the information security program. In addition, the Company's and the Bank's regulators review and assess the Company's information security program on an annual basis.


text: The Company also maintains certain management committees that further assist in the prevention, detection, and mitigation of cybersecurity risks. Specifically, the CISO works closely with the Company's IT Steering Committee which, among other things, reviews the effectiveness of key controls and provides guidance around future initiatives that strengthen the Company's overall security posture. The IT Steering Committee is comprised of key executives such as the President and Chief Executive Officer and Chief Financial Officer, as well as senior employees that specialize in technology and information security, including the Company's CISO, Chief Technology Officer, and Chief Risk Officer, and representatives from the Board. This committee also monitors current events regarding cybersecurity threats to the Company and more broadly to the financial services industry to help the Company make informed decisions around any necessary internal control enhancements or adjustments. In addition to the IT Steering Committee, the IT Subcommittee assists the CISO to prevent, detect, mitigate, and remediate cybersecurity threats and incidents. The IT Subcommittee typically meets quarterly and consists of members of the information technology and information security teams, the Director of Internal Audit, and senior management members of various business units. This committee is responsible for reviewing information technology and information security projects and the threat landscape.


text: Given the importance of maintaining the security of the Company's systems and information, cybersecurity risks are also reviewed and addressed relative to assessing new products and services and any third-party services providers that may be engaged to provide systems and services to the Company. As an essential element of the Company's cybersecurity program, the Company maintains a third-party service provider management program that assesses and addresses the risks associated with third parties providing systems, software and programs that access the Company's information. As part of this oversight, the Company's Risk Management, Legal and/or Information Security Departments review higher risk and material contracts with third party service providers, which includes an evaluation of the cybersecurity risks presented, any safeguards, and service organization controls reports provided by the third parties. Initial and continuing due diligence is also conducted on third party service providers to ensure that they are fulfilling their contractual obligations and satisfying the Company's data security requirements.


text: Risk Management and Strategy We review cybersecurity risk as part of our overall enterprise risk management program. This ensures that cybersecurity risk management remains a top priority in our business strategy and operations.


text: The CISO is also responsible for monitoring data security incidents at third parties who have access to the Company's information which may impact the Company or its customers if it was compromised. When the Company becomes aware of such events, the CISO engages with the impacted third-party service providers to understand the incident, assess the risk that the Company's information was released, and determine methods by which the Company can mitigate the damage, if any, and fulfill its notification obligations to impacted parties.


text: In an effort to remain vigilant against cybersecurity attacks, the Company further provides annual and ongoing training to all of its employees so that they have an understanding and appreciation of the cybersecurity environment and risks and the Company's policies to combat such risks. Such training includes annual mandatory training sessions on cybersecurity for all employees, periodic informational notices regarding emerging threats, and periodic testing to ensure employees are reporting suspicious activities and are diligent in their efforts to avoid phishing attacks and cybersecurity breaches. The CISO also conducts and participates in annual table top exercises with management, and periodically with Directors, in order to be prepared in the event of a material cybersecurity event.


text: The Company's cybersecurity process and its ability to assess, manage, and remediate cybersecurity risks further centers around good communication among management. Management stays informed on cybersecurity risks through open communication with the Risk Management team, including through various reports and weekly reporting by the Chief Risk Officer to the Senior Management Committee about cybersecurity matters, as necessary. In the event there is a material cybersecurity incident, the Company's policies and procedures set forth an action plan, which includes notification of the appropriate personnel and management within the Company as well as regulators and impacted customers, as applicable. For cybersecurity incidents, including, but not limited to, incidents that are deemed material pursuant to SEC cybersecurity disclosure rules or that significantly impact vital services provided by the Company, notification to the Board will occur at or about the time the incident is discovered. Less severe incidents will be reported by management at the next Board or Risk Committee meeting.


text: Board of Directors' Role in Cybersecurity An integral part of Company's risk management oversight, which includes information security, is the role of the Board. This is reinforced by the independence and reporting structure of the Chief Risk Officer, who oversees the CISO and reports to the Board Risk Committee and administratively to the President and Chief Executive Officer.


text: In addition, cybersecurity risk is a fundamental risk of the Company which is overseen by the Risk Committee of the Board, including Directors with experience in risk management, internal audit, cybersecurity and/or the operations of financial service companies. In particular, the Chair of the Board, Eric E. Stickels, has experience with the risks associated with operating a financial institution based upon his prior service as the President of Oneida Financial Corp. In addition, Lead Director Susan E. Skerritt, the former Chief Executive Officer and President of Deutsche Bank Trust Company Americas, as well as director Kerrie D. MacPherson have received the Cyber-Risk Oversight Certification issued by the National Association of Corporate Directors ("NACD"), and utilize their business experience and cyber-risk expertise to assist the Risk Committee in its evaluation of management's cybersecurity systems. Directors Knauss and Singh also serve as Board representatives on the Company's IT Steering Committee and provide valuable oversight and insight to the committee based on their respective roles as (i) the former CEO of a digital marketing firm and (ii) current CEO of PAR Technology Corporation ("PAR"), a global food service technology company providing leading omnichannel cloud-based software and hardware solutions to the restaurant and retail industries.


text: The Risk Committee meets five times a year during which management provides updates to the committee regarding the material risks facing the Company. As part of this reporting, the Chief Risk Officer and the Risk Management Department have created a risk management program that identifies and evaluates the risks associated with various aspects of the Company's business and report their assessments to the Risk Committee for review or approval. Within the risk management process, cybersecurity risks are specifically reviewed and addressed, including risks related to current or proposed products and services to be offered by the Company, as well as the efforts taken or to be taken to mitigate such risks.


text: In addition, on at least a quarterly basis, the CISO presents an Information Security report to the Risk Committee, which includes the Company's cybersecurity alert level, controls rating, current and emerging cybersecurity risks, threats and trends, mitigation efforts and projects and audit and regulatory updates.


text: On an annual basis, the Board's Audit Committee also receives reports from outside consultants who perform various IT related audits, and the Company's independent registered public accounting firm regarding the effectiveness of the Company's cybersecurity program in connection with its review of the Company's financial statements.


text: Identification: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, consumers, employees and other stakeholders and oversees cybersecurity matters. Management plays a central role in our information security program, which is a critical component of our enterprise risk management and includes the implementation of controls generally aligned with industry best practices and applicable frameworks to identify threats, deter attacks and protect our Company assets. We also include cybersecurity training as part of our mandatory, periodic employee training program. In addition, we engage a range of cybersecurity experts, including cybersecurity auditors, assessors, and consultants, in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to help ensure that our cybersecurity strategies and processes remain in line with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultations on security enhancements.

companyName: Monster Beverage Corp

ticker: MNST


text: Our Chief Information Officer and his team are responsible for leading our cybersecurity strategy, policy, standards, architecture, and processes. Our information security leadership team has more than 20 years of combined experience in cyber and information security matters. Our information security program is also supported by our Chief Compliance Officer and other members of senior management. We conduct periodic reviews of our program by internal and external experts with the results of those reviews reported to senior management and the Board. Moreover, the Audit Committee of our Board (the "Audit Committee") reviews our cybersecurity matters with our Chief Information Officer at each of its quarterly meetings. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners. For example, we require certain third-party service providers and other business partners to provide us with SOC II reports that demonstrate alignment with security standards. We also actively engage with industry participants as part of our continuing efforts to evolve our cybersecurity governance.


text: Our information security team promptly informs our Incident Response Team of potentially material cybersecurity incidents, including with respect to our third-party service providers. The Chief Information Officer briefs our Co-Chief Executive Officers and reports to the Audit Committee. The Audit Committee, in turn and if appropriate, briefs the Board on, among other matters, our cyber risks and threats, the status of projects to strengthen our information security systems (such as employee cybersecurity training), an assessment of the information security program, and the emerging threat landscape. The Cybersecurity and Compliance Steering Committee, comprised of senior members of management, convenes on a quarterly basis to review all matters related to strengthening our cybersecurity posture and providing governance.


text: For a discussion regarding risks from cybersecurity threats that are reasonably likely to affect the Company, see "Part I, Item 1A – Risk Factors – Our use of information technology exposes us to cybersecurity attacks and other interruptions that could disrupt our business operations and adversely impact our reputation and results of operations," "Cybersecurity attacks, business interruptions, and compliance issues experienced by third parties could materially and adversely affect our financial condition, results of operation and cash flows" and "If we fail to comply with data privacy and personal data protection laws, we could be subject to adverse publicity, government enforcement actions and/or private litigation, which may negatively impact our business and operating results."

stage1Category: None/Other


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Annual Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Annual Report.

companyName: TLGY ACQUISITION CORP

ticker: TLGYF


text: Theriva has not, to date, been subject to any cybersecurity incidents resulting in a material adverse effect on the Company; however, future cyber incidents may occur and the Company has implemented processes to manage, mitigate, and respond to cybersecurity threats. We maintain policies and controls over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our information technology ("IT") assets, data, and services from threats and vulnerabilities. We partner with third-party IT providers leveraging third-party technology and expertise. These partners, including consultants and other third-party service providers, are a key part of Theriva's cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, and cyber risk advisory, assessment and remediation.

companyName: Theriva Biologics, Inc.

ticker: TOVX


text: Assessment: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, management and the Audit Committee oversee cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Theriva's management team is responsible for oversight and administration of cybersecurity risk management strategies, and for informing the Board and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Theriva acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: Cybersecurity and Risk Management The Company's cybersecurity risk management processes are integrated into the overall risk management process managed by the Chief Risk Officer through reporting of cyber risks to the Information Security Steering Committee (ISSC). The cybersecurity risk management processes will be transitioned under the Chief Information Officer's division for the 2025 year. The ISSC is chaired by the Managing Director of Information Security, who has 18 years of information technology (IT) and information security experience in the financial services industry. Key metrics are monitored on an ongoing basis by the IT Risk Management and IT Security teams, with oversight by the ISSC. IT Risk Management performs regular information security-focused risk assessments, including but not limited to assessments based on the Center for Information Security Controls Self-Assessment Tool and Ransomware Self-Assessment Tool aligned to the Federal Financial Institutions Examination Council standards.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: IT Risk Management maintains processes for prevention, detection, and mitigation of cybersecurity incidents. The Company maintains an Incident Response Plan (IRP) that covers response and remediation processes for managing cybersecurity incidents. The Incident Response Team (IRT) members include senior management and other relevant personnel, with defined roles and responsibilities. IRP metrics related to monitoring and detection are presented to the ISSC and reported to the board. The IRT is notified of all incidents, and incidents are elevated to the board when warranted.


text: Engagement of Third Parties The Company utilizes third parties for some cybersecurity services, including but not limited to managed security services, external and internal penetration testing, social engineering tests, third party risk reviews and tabletop exercises.


text: Oversight and Identification of Risks Associated with Third Parties Third Party Risk Management, a component of IT Risk Management, reviews new vendors prior to onboarding to oversee and identify potential risks and performs ongoing monitoring of emerging risks related to third-party service providers. Third-party service provider reviews include completion of a standardized questionnaire and risk reviews for financial, reputation, information security, cybersecurity, and business resiliency risk. These reviews are reported to the Information Technology Steering Committee (ITSC) for approval of new applications. The ITSC is chaired by the Chief Information Officer, who has more than 20 years' experience in IT management and cybersecurity, predominantly in the financial services industry. IT Risk Management performs contract reviews for security controls and notification processes. IT Risk Management also conducts annual IT risk assessments on critical and high risk applications.


text: Risks from Cybersecurity Threats In the last fiscal year, the Company did not experience any material cybersecurity incidents. For additional discussion of cybersecurity-related risks facing the Company, see Item 1A. Risk Factors.


text: In connection with the board's oversight of risk management, cybersecurity updates are provided to the board at least quarterly, including, but not limited to, the following materials: Annual Gramm-Leach-Bliley Act Information Security Program (ISP) Report, IT Risk Management and IT Security Metrics, Penetration Testing and Tabletop Exercise updates, IT Risk Assessments, Disaster Recovery Test Results, Third Party Risk Management Metrics, Incident Response Metrics, Security Awareness Training Metrics and additional cybersecurity education topics.


text: Management: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.


text: Management's Role in Managing Cybersecurity Risk Our Company is proactive in managing the material risks from cybersecurity threats, which is reflected in the establishment of a dedicated committee responsible for overseeing such risks. This committee is composed of the following individuals: Kamran Shamaei, Chief Technology Officer, who provides technical leadership and strategic direction for all technology-related decisions, including cybersecurity.


text: We recognize the critical importance of maintaining the trust and confidence of our patients, employees, and business partners toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our audit committee and board of directors are involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. We have taken into account recognized frameworks established by the National Institute of Standards and Technology, or NIST, when developing cybersecurity policies, standards, processes and practices among other considerations. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Profound Medical Corp.

ticker: PROF


text: Cybersecurity Risk Management and Strategy: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including phishing training, regular network and endpoint monitoring, audits and vulnerability assessments to inform our risk identification and assessment.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care and enter into confidentiality agreements, and enter into data processing agreements with third parties that are processing personal data we control;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including physical security measures to prevent access to data processing systems, firewalls, intrusion prevention and detection systems, email security controls, anti-malware functionality and access controls, endpoint detection and response systems, all of which are evaluated and improved through internal and external vulnerability assessments and cybersecurity threat intelligence;


text: provide mandatory training and notifications for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to understand, identify and address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: conduct mandatory annual phishing training and regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; utilize pseudonymized data for patients and use other encryption methods to ensure security of personal data;


text: leverage procedures informed by appropriate incident handling frameworks to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we engage with third parties, including annually having a qualified third-party review our incident response plan and our cybersecurity measures to help identify areas for continued focus, improvement and compliance.


text: We have processes in place to identify, review and evaluate cybersecurity risks associated with our use of third-party service providers. These reviews are conducted at onboarding and periodically throughout the tenure of the service provider based on risk tier rating of each service provider. We believe these processes enable us to evaluate a third-party service provider's security posture, identify risks that may arise out of our use of the third party's service, and make decisions regarding acceptable levels of risk and risk mitigation.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and assess cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, for example, by engaging with known, reputable vendors, and requiring they have industry standard safeguards and notification procedures. We may also ask vendors associated with increased cybersecurity risk to complete a periodic questionnaire regarding their security practices for ongoing vendor management purposes.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance: Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. The board of directors is responsible for the oversight of risks from cybersecurity threats.


text: Annually, our audit committee and board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our members generally receives information that includes a cybersecurity summary and other information discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee and board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer in consultation with our Chief Executive Officer and Legal Counsel. Such individuals and their respective teams have collectively over ten years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee and our board of directors annually about cybersecurity threat risks, among other cybersecurity related matters.


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our initial public offering. In addition to our own cybersecurity risks, any proposed Business Combination target, such as Youlife, may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Distoken Acquisition Corp


text: Risk Management and Strategy We recognize the importance of cybersecurity in our operations. We face diverse cybersecurity threats, ranging from unauthorized individual access attempts to sophisticated disruptions targeting our business and customer data. Our operations involve collecting and storing customer information in cloud systems, such as Google Drive, and we rely on third-party providers, such as Google, whose systems may encounter interruptions and/or cybersecurity incidents.

companyName: CHEETAH NET SUPPLY CHAIN SERVICE INC.

ticker: CTNT


text: Our parallel import vehicle business depended on the continuous functioning of our OA System, which tracked order status and monitored business workflows. Similarly, our logistics and warehousing business relies on the functioning of our freight forwarding software, GoFreight. The secure handling of information is crucial, particularly for tracking automobile orders. We have implemented various measures, such as access controls, data encryption, and vulnerability assessments, to prevent and mitigate cybersecurity risks and incidents. In particular, we have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, which is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. We have developed a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also developing tools and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including Squarespace and Google Workspace, which assist us with information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. We engage in the assessment and testing of our cybersecurity risk management program, policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate. However, cybersecurity incidents, if they occur, depending on their nature, could lead to the loss, destruction, or unavailability of critical and confidential data, impacting our operations and potentially harming our reputation. This could result in customer distrust, termination of partnerships, significant remediation costs, and legal liabilities.


text: As of the date of this annual report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating and Corporate Governance Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee receives reports from management on potential cybersecurity risks and threats. Our management plays a key role in assessing and managing our material risks from cybersecurity threats, with designated positions and committees equipped with the necessary expertise. The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel and threat intelligence and other information obtained from governmental, public, or private sources.


text: Risk Management and Strategy The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by the Board, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impacts from cybersecurity threats, escalating to management and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: We use specialized IT tools and services, including with the support of third-party service providers, to understand, manage, mitigate and continually remediate identified threats. The Company logs identified cybersecurity threats and tracks corresponding risk management activities. Identified cybersecurity threats are discussed with management for resolution planning and escalation.


text: Testing of our security controls in connection with the auditing of our financial systems is completed annually. At least annually, we conduct training and awareness for our employees to help identify, avoid and mitigate cybersecurity threats.


text: We regularly evaluate the cybersecurity threats associated with third-party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third-party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we seek to make third-party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While we have implemented a cybersecurity program, the techniques used to compromise IT systems continue to evolve. Accordingly, we may not be able to timely detect cybersecurity threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A – Risk Factors."


text: The Board is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The CEO and CFO report on cybersecurity matters, including material threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors.


text: It is management's responsibility to manage cybersecurity threats, as described above, and bring to the Board's attention any material threats. Under the oversight of the Audit Committee, the Company's CEO is primarily responsible for the assessment and management of cybersecurity threats and utilizes third-party consultants retained by the Company for advice.