text: The Company maintains an enterprise-wide risk management ("ERM") process to identify, assess and monitor risks that are or may become material to our business. Our ERM process includes participation by senior management, other leaders, and employees across the business in surveys and discussions about the risk environment with certain members of senior management and management level leaders meeting quarterly to discuss the Company's top risks as identified through our ERM process.


text: Our cybersecurity policies and controls encompass incident response procedures, information security, and IT vendor risk management. We monitor the cybersecurity laws, regulations, and guidance applicable to us in the maintenance of these policies and procedures, including, but not limited to, regulations issued by the U.S. Department of Homeland Security, as further described in Item 1 (Business) of this Annual Report on Form 10-K, as well as proposed laws, regulations, guidance, and emerging risks.

companyName: ARCBEST CORP /DE/

ticker: ARCB

secItem: Item 1C


text: We utilize various tools and security technology to help us deter, detect, identify, and respond to potential cybersecurity threats. Annually, we undergo external evaluations by third-party consulting services, including the performance of penetration testing and vulnerability scanning. With respect to third-party service providers, we generally require our vendors to maintain security controls to protect our confidential information and data, and we perform risk assessments of IT vendors, including their ability to protect data from unauthorized access. When the Company learns of a cybersecurity incident at a third-party service provider, the Company's respective department contacts maintain communication with the third-party service provider and communicate the incident to our Chief Technology Officer ("CTO"). As described in Part 1, Item 1A (Risk Factors), our operations rely on the secure processing, storage, and transmission of confidential and other information in our IT systems and networks. Computer viruses and other events beyond our control, including cybersecurity attacks and other cyber incidents such as denial of service, system failure, security breach, intentional or inadvertent acts by employees or vendors with access to our systems or data, or disruption by malware, could expose our IT systems and those of our vendors to system interruptions, impacting the availability, reliability, speed, accuracy, and other proper functioning of these systems or result in the release of proprietary information or sensitive or confidential data, any of which could materially and adversely affect our business. Because the sophistication of cybersecurity threats is increasing and new techniques for attack are being developed rapidly, including attacks enabled by artificial intelligence, we cannot be certain that the controls and preventative actions that we have implemented to reduce the risk of cybersecurity incidents and to protect our systems will be effective in preventing a cybersecurity incident from materializing. While we have experienced minor cybersecurity incidents, we are not aware of any material cybersecurity incidents that occurred during the year ended December 31, 2024. Our Audit Committee, with delegated authority from our Board of Directors, has primary oversight of cybersecurity risks.

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our CTO and Director of Information Security are responsible for oversight of the Company's cybersecurity program, implementation and compliance of our information security standards, and mitigation of information security-related risks. Our CTO, with 38 years of IT experience and an undergraduate degree in Computer and Information Science, has served in his current role for five years and previously served as our director of infrastructure management for 12 years. Our CTO reports directly to the Company's Chief Innovation Officer and indirectly to the Company's President of ArcBest Technologies, who directly reports to the Chief Executive Officer. Our Director of Information Security, reports to our CTO, has 33 years of IT experience, including over 20 years in information security; a Master of Business Administration; an undergraduate degree in Computer Information Systems and Quantitative Analysis; and is a Certified Information Systems Security Professional.

stage1Category: Management Role


text: We also have management-level committees who support our processes to assess and manage cybersecurity risk and related incidents as follows:


text: The Information Security Committee, chaired by our Director of Information Security, includes IT, legal, compliance and other business leads. The Information Security Committee provides a forum for these cross-functional members of management to consider existing and emerging cybersecurity risks; review cybersecurity regulations; determine cybersecurity project prioritization; approve, review, and update policies and standards, as appropriate; and promote cross-functional collaboration to manage cybersecurity risks across the enterprise to support the Company's goals and address cybersecurity risks.

stage1Method: majority


text: The Risk Management Committee, comprised of senior IT, operations, risk, legal, and compliance leaders across business segments, monitors enterprise risk management for the Company, including all subsidiaries. Among other processes, this committee reviews the Company's programs and processes related to information security, third-party risks, vendor management, business disruption, business continuity, and disaster recovery, identifying gaps in the current risk management processes and considering potential risks due to changes in laws or the regulatory environment.


text: The Cybersecurity Incident Response Team, which includes representatives from our information security and technical services departments, in addition to company management and executives across the Company, is activated when a suspected incident is reported or discovered and is responsible for dissemination of information and coordination of personnel efforts required to successfully respond to an incident.


text: The Cybersecurity Incident Reporting Committee was formed to assess the materiality of cybersecurity incidents from a Securities and Exchange Commission reporting standpoint. In the event this committee determines a cybersecurity incident is material, committee members, as delegated, will notify the Audit Committee. The CTO provides a quarterly cybersecurity risk update and presents an annual cybersecurity review to our Board of Directors.


text: We also conduct mandatory company-wide security awareness training and periodic phishing tests and generally seek to promote awareness of cybersecurity risks through regular communication and education of our employees.


text: Cybersecurity Risk Management and Strategy In today's increasingly interconnected world, cybersecurity is not just a concern, it's a fundamental responsibility. At Monarch Casino & Resort, Inc., we understand that the security of our digital assets is essential to safeguarding our critical infrastructure, ensuring the confidentiality and integrity of sensitive information, maintaining business continuity, and fostering trust with our stakeholders.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: We are developing and implementing a robust and comprehensive cybersecurity program that aligns with industry best practices, regulatory requirements, and our Company's specific risks in the evolving threat landscape. This program is designed to not only address current challenges but also proactively position us to mitigate future risks and maintain a resilient digital posture.


text: We maintain cybersecurity risk insurance, conduct threat scenario exercises, provide end user cyber awareness and security training, perform regular vulnerability audits and formally report the relevant results, statuses or assessments to our senior management team or other identified key stakeholders.

companyName: Southland Holdings, Inc.

ticker: SLND


text: The foundation of our cybersecurity framework is built on continuous risk management practices. We conduct regular threat assessments, administrative reviews, and vulnerability scans to proactively identify and evaluate cybersecurity risks. Our strategy is developed to be in harmony with our business objectives, incorporating industry best practices, staying abreast of evolving cyber threats, and complying with regulatory standards.


text: Recognizing the critical role of human factors in cybersecurity, we implement comprehensive education and awareness programs for all employees. These programs are designed to promote safe online practices and encourage prompt incident reporting. Additionally, we conduct phishing simulations and other exercises to measure and improve our employees' ability to recognize and respond to cyber threats effectively.


text: Our incident response and recovery planning is a key component of our cybersecurity efforts. We have developed and documented an incident response plan that outlines specific procedures for identifying, containing, and remediating cyber incidents. Regular testing of this plan ensures its effectiveness, with adjustments made as necessary. Furthermore, we maintain backups of essential data and systems to enable swift recovery from any cyber incidents.


text: On the technical front, we deploy a variety of safeguards to protect our systems. These include firewalls, intrusion detection and prevention systems, data encryption, and strict access controls. Regular updates and patches are applied to software and firmware to mitigate known vulnerabilities and strengthen our security posture.


text: Risk assessment is an ongoing process within our organization. We routinely perform assessments to identify, analyze, and prioritize cybersecurity risks. The outcomes of these assessments directly inform our cybersecurity strategy and guide the allocation of resources.


text: In response to the recent SEC cybersecurity disclosure rule, we have updated our cybersecurity program to incorporate the requirements to disclose, as appropriate or required and if deemed to be material, such a material incident via a Form 8-K within four (4) business days of determining the occurrence of such a cybersecurity incident.


text: Management's Role Our chief information officer and our security architect are responsible for day-to-day assessing and managing the cybersecurity risk and threats through internal assessment tools as well as third-party control tests, for audits and evaluation against industry standards and regulations. Our chief information officer has over twenty-five years leading IT and Cybersecurity teams and continually improve his expertise through cybersecurity classes and collaborate with cybersecurity professionals in hospitality industry.


text: In addition, we have a management Cybersecurity committee, which is comprised of chief executive officer, chief information officer, corporate director of internal audit and executive vice president of finance. The Cybersecurity committee is responsible to set strategy and ensure our cybersecurity program is consistently evaluated and kept up to date with the latest developments in the cybersecurity.


text: Board of Directors Oversight Our board of directors plays a crucial role in overseeing our cybersecurity program. The board receives regular updates on cybersecurity program's status and effectiveness by the Cybersecurity committee. The audit committee oversees the cybersecurity program and provides strategic guidance to management, ensuring that our approach to cybersecurity remains robust, proactive, and aligned with our business needs.


text: Cybersecurity Risk Management We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. In the ordinary course of our business, we use, store, and process data, including data of our employees, partners, collaborators, and vendors. Cybersecurity threats and incidents include attempts to gain unauthorized access to our systems and networks, or our partners, collaborators, vendors, or other third parties with whom we do business, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our business. To help the Company identify, assess, and mitigate risks to this data and our systems, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same.

companyName: PLUG POWER INC

ticker: PLUG


text: Annually, the Security Committee (defined below) conducts a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes and inform a broader enterprise-level risk assessment that is analyzed by the Security Committee and presented to the board of directors, Audit Committee and members of management.

companyName: CPI Card Group Inc.

ticker: PMTS


text: Technical Safeguards The Company's cybersecurity program evaluates new threats to learn new attacker techniques, adopt defenses and implement new safeguards to protect our information systems from cybersecurity threats. These safeguards are evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Independent assessments of the safeguards by external third-party consultants, which also include the detection of threats, are evaluated and improvements to systems are incorporated.


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. In 2024, Plug continued to fortify its comprehensive cybersecurity and risk controls. We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company and evaluate potential risks consistent with industry practices, customer requirements, and applicable law, including privacy and other considerations. We mandated an annual cybersecurity awareness training module, enhanced our Information Technology Infrastructure Library (ITIL) based discipline of change and incident management, and overhauled our monthly patching/vulnerability management rigor. Additionally, Plug continued leveraging top-tier third party support for external and perimeter examination: completing exhaustive Penetration Testing and Vulnerability Scans (performed by OrbitalFire), establishing a robust Network Operations Center (NOC), and leveraging industry-leading endpoint monitoring and detection services (CrowdStrike). Additionally, we have implemented an employee education program whereby employees are able to attend cybersecurity awareness training during the onboarding process.


text: The Vice President of Information Technology (" VP of IT ") oversees the daily operations of our cybersecurity risk management program and plays a central role in assessing and managing critical risks from cybersecurity threats with the support of additional IT professionals. The VP of IT role is currently held by an individual who has approximately twenty years of experience in information security management, application portfolio management, and IT governance, risk, and compliance. The VP of IT periodically reports on the cybersecurity program to the Chief Financial Officer ("CFO").


text: Our governance framework includes oversight by the Audit Committee of the Board of Directors. The Audit Committee meets quarterly with the CFO regarding the cybersecurity risk management program, including as relates to critical cybersecurity risks and cybersecurity initiatives and strategies. Additionally, on an annual basis, the VP of IT reports the current state of cybersecurity risk management to the full Board of Directors. The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we have experienced, and we may in the future experience, threats to and breaches of our data and systems, including ransomware attacks and phishing attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "We are dependent on information technology in our operations, and the failure of such technology may adversely affect our business. Security breaches of our information technology systems, including cyber-attacks, ransomware attacks, or use of malware or phishing or other malicious techniques by threat actors, have in the past and could in the future lead to liability, impact our operations, or damage our reputation and financial results" in Item 1A, "Risk Factors".

stage1Category: Strategy Integration


text: Cyber threat actors and the types of threats posed are becoming more sophisticated and effective and are increasingly targeting commercial companies. In seeking to mitigate these cyber threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data, customers and other stakeholders entrusted to us, a top priority. The board of directors and our management are actively involved in the oversight of our risk management program, which includes cybersecurity. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. There may be instances where our policies and procedures are not properly followed or where such policies and procedures prove to be ineffective. As of the date hereof, we are not aware of any material risk from cybersecurity threats that has materially affected the Company, including our business strategy, results of operations or financial condition. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding risks related to system security risks, data protection breaches and cyber-attacks, see the risk factor entitled "System security risks, data protection breaches, and cyber-attacks could compromise our proprietary information, impair customer and vendor relationships, disrupt our internal operations, harm perception of our products and expose us to litigation and/or regulatory penalties, which could have a material adverse effect on our business and our reputation" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy Our policies and processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: We work to identify and address our cybersecurity risks through a comprehensive, cross-functional approach. Key security, risk and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to encourage prompt escalation of certain cybersecurity incidents so that decisions regarding customer and supplier disclosure, public disclosure and reporting of such incidents can be made by management and the board of directors in a timely manner.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Our Company policies require our employees to assist in the protection of our customers' data. We have various training programs, conducted frequently, designed to heighten employees' awareness of current threats, educate them on effective mitigation strategies and reinforce the importance of handling and safeguarding customer and employee data in accordance with our established security protocols. To evaluate the effectiveness of these training programs and monitor the effectiveness of our security controls, we have implemented mock testing practices. Annual incident response training is conducted for administrative personnel that would be expected to be involved with, and respond to, a security incident.


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. We conduct regular independent cyber audits to assess our controls and alignment against the NIST Cybersecurity Framework, compromise assessments to baseline and assess if a current or past compromise had occurred within our infrastructure, and maintain industry certifications and attestations that demonstrate our dedication to protecting customer data. The results of significant assessments are reported to management, the board of directors and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: The board of directors, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee, as part of its risk oversight function, is responsible for overseeing our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments and relevant internal and industry cybersecurity incidents.


text: Management's Role Our Chief Information Security Officer ("CISO"), Chief Information Officer ("CIO"), Chief Technology Officer ("CTO"), Chief Legal and Compliance Officer ("CLCO") and Director of Information and Cybersecurity ("DC") have primary responsibility for assessing and managing material cybersecurity risks and are members of an internal committee that reviews issues and initiatives related to data security and privacy (the "Security Committee"), which drives alignment on security decisions across the Company. The CISO has over 20 years of experience in various roles related to information security and related technology, including roles specific to managing security requirements related to organizations operating in the payment card industry. The CIO, CTO and DC also each have over 20 years of experience serving in various roles in information technology fields; the CIO has over 25 years of global technology leadership across fintech, software, and payments industries, leading technology, product, and engineering organizations for multinational companies, with extensive experience in implementing software solutions and managing risk across the entire technology lifecycle. The CTO has been with the Company since 2014 and the DC previously served as the Chief Information Security Officer at an IT services and consulting company. The CLCO has over 20 years of experience managing risks and related disclosure requirements, including risks arising from cybersecurity threats, at publicly traded companies. The Security Committee meets at least quarterly to evaluate security performance metrics, prioritize risks identified through threat intelligence, vulnerability and risk assessments, external audits, and incident response insights, and review the progress of approved security enhancements. The Security Committee also considers and makes recommendations to the Audit Committee on security policies and procedures, security service requirements and risk mitigation strategies.


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party vendors. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our risk management and compliance program.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our cybersecurity policies, standards, processes and practices are fully integrated into the Company's enterprise-wide risk management and compliance program and overseen by the Audit Committee, and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Risk Management and Strategy As one of the critical elements of the Company's overall risk management and compliance approach, the Company's cybersecurity program is focused on the following key areas:


text: Governance: The board of directors' oversight of cybersecurity risk management is led by the Audit Committee of the board of directors, which regularly interacts with our Chief Compliance Officer, our Chief Financial Officer, and other members of management.

stage1Category: Board Governance


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, Security Information and Event Management systems, Extended Detection and Response with 24/7 Security Operations Center, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind.


text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The board of directors, with leadership from the Audit Committee, oversees our cybersecurity risk management process. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with management.


text: Our management team has implemented a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our enterprise risk management team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. Our Chief Financial Officer, Kathleen Borthwick, currently serves as our Chief Cybersecurity Officer and leads our cybersecurity risk assessment and management processes. Prior to being named CFO, Ms. Borthwick served as the Company's Senior Vice President, Finance, and interim CFO. She is supported by external Information Technology and third-party internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training, and risk management efforts.


text: No cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials and product, product candidates, and technology or our Information Systems and Data.

companyName: Y-mAbs Therapeutics, Inc.


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology (the "NIST"), the Control Objectives for Information Technologies ("COBIT") framework and the International Organization Standardization 27001, Information Security Management System requirements. We have an annual assessment, performed by our internal audit department, of our cyber risk management program against the NIST and COBIT frameworks.

companyName: W&T OFFSHORE INC

ticker: WTI


text: We have a multi-stakeholder team to help identify, assess, and manage the Company's cybersecurity threats and risks, comprised of representatives from our third-party IT administrator, and from our Legal and Compliance, and Finance departments. This team, along with our third-party IT service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using automated monitoring tools, subscribing to analysis and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external review of certain data and systems, and having third parties conduct periodic assessments of our threat environment. We continue to invest in talent and infrastructure in our IT department to manage IT operations and mitigate cyber risk.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example maintaining an incident response policy and incident detection and response procedures, disaster recovery and business continuity plans and an IT contingency policy, encrypting certain data, conducting risk assessments for certain data and systems, implementing certain network security, physical and access controls, monitoring our systems, providing periodic training to employees and using tools such as penetration testing tools.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT and Legal and Compliance departments work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, our third-party IT service provider, cybersecurity consultants, outside legal counsel, software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, including hosting providers, CROs, and CMOs. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes, as appropriate, risk assessments of vendors, reviewing our vendors' information security program, reports, audits, and imposing relevant contractual obligations on our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the heading "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences"

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our Senior Director of IT, and our Chief Financial Officer, and Treasurer, or the CFO.


text: Our Senior Director of IT is currently responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO has the overall IT and cybersecurity responsibility and is currently responsible for approving IT and cybersecurity related policies, processes, and procedures, approving related activities and budgets, helping prepare for cybersecurity incidents, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and our President and Chief Executive Officer, as appropriate and provides for our management team to work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: As part of its oversight of the Company's overall risk management, the audit committee is periodically updated by our CFO concerning cybersecurity threats and risks and the processes the Company has implemented to address them.


text: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. We have adopted a Cybersecurity Incident Response Plan that applies if a security event occurs. Our Incident Response Plan provides a common framework for responding to security incidents. This framework establishes procedures for identifying, validating, categorizing, documenting, and responding to security events that are identified by or reported to the Chief Information Officer ( "CIO "). Our Incident Response Plan applies to our personnel including contractors and partners that perform functions or services that require securing our information assets, and to all devices and networks that we own. The Incident Response Plan details the coordinated, multi-functional approach for investigating, containing, and mitigating incidents. Under our Incident Response Plan, cybersecurity incidents are escalated based on a defined incident categorization to the CIO and the General Counsel. Regular updates are provided by the Cybersecurity team to the CIO, who will maintain communication and information flow to senior leadership including the General Counsel, Chief Financial Officer, and other cybersecurity program stakeholders as well as the Audit Committee and/or the Board of Directors as appropriate. Generally, our incident response process follows the National Institute of Standards and Technology (NIST) framework and focuses on preparation; detection and analysis; containment, eradication, recovery and post-incident remediation.


text: Our CIO leads the information security organization which oversees the identification and management of information security risks. Our CIO has extensive information security and risk management experience in Information and Operational technology and holds the following information security certifications: Certified Information Systems Security Professional (CISSP); Certified Information Systems Auditor (CISA); and Certified Risk and Information Systems Control (CRISC).


text: Our CIO is a member of InfraGard, ISC2 and ISACA and serves as Adjunct Professor of Cyber Security at Lone Star College and San Jacinto College.


text: We conduct mandatory security training during new employee onboarding, as well as require our employees to complete annual security risk training and, when necessary, perform additional updated training. We also engage certain third-parties in assessing, identifying and managing cyber-security risks. These third parties perform a number of services, including managed detection and response services for information technology endpoints, anti-virus monitoring, penetration testing, and other miscellaneous cyber security programs and services. We maintain specific policies and practices governing our third-party security risks, including our third-party assessment process. Under our third-party assessment process, we gather information from certain third parties who contract with us and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us.


text: The Audit Committee of our board of directors oversees our cybersecurity policies, procedures, risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Our executive management, including our Vice President and Chief Information Officer, periodically updates and reports to the Audit Committee and the board of directors regarding cybersecurity risk exposure and our cybersecurity risk management strategy (at a minimum, once per quarter). Additionally, all members of the board of directors attend quarterly training sessions through internal and external IT specialists, which include review of IT whitepapers, presentations, and other learning materials. Each of the members of the board of directors has also completed certificated training concerning IT security, IT fraud, and other common enterprise-level IT threats.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To our knowledge, such risks have not materially affected our operations nor have we experienced any cybersecurity incidences which have impacted our operations. In the past three years, we have not experienced a material information security breach. We will continue to face cybersecurity threats whether directly or through our supply chain or other channels in the normal course of business. See Risk Factors in Part I, Item 1A in this Form 10-K for additional information.


text: Cybersecurity risk management and strategy The Company integrates risk management into its overall cybersecurity strategy and has implemented processes designed to identify, assess, prioritize, and manage risks to protect data, intellectual property, and information assets. As part of our risk governance and management, the Company has developed procedures to identify and evaluate risks, measure them against predefined criteria, devise and execute strategies to mitigate identified risks, continuously monitor and review risk profiles, and communicate risks to management and relevant stakeholders. Addressing cybersecurity risks involves a comprehensive approach that encompasses both internal assessments and external information sources. For instance, the Company engages in security assessments conducted by internal and external experts to ensure compliance with security policies and industry frameworks; and vulnerability assessments to discover vulnerabilities in networks, systems and applications. The Company has strategically reduced its hardware footprint by eliminating on-premise datacenters and moving IT infrastructure into cloud-hosted and Software as a Service (SaaS) providers. As a result, the Company believes it is streamlined and agile to respond quickly to market fluctuations and changes in the industry. Additionally, the Company leverages cloud-hosted and SaaS providers that offer Service Level Agreements (SLAs) and adhere to compliance and regulatory requirements for the industry. We oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk. The Company performs ongoing risk assessments that evaluate IT systems and assess the likelihood of occurrence, estimate potential impact, and plan for remediation.

companyName: Vireo Growth Inc.

ticker: VREOF


text: Accountability and auditing IT Management ensures that the Company's risks are properly monitored, managed and mitigated to the extent possible; and oversees the implementation and maintenance of formal strategies that govern information resources.

companyName: ATEL 16, LLC


text: Cybersecurity Governance Cybersecurity risk management is overseen by the Company's Vice President of Information Technology and Security who is supported by full-time information security staff. These individuals have experience across industries that, among other things, develops and distributes information security policies, standards and procedures; engages in employee cybersecurity training; implements security controls; assesses security risk and compliance posture; monitors and responds to security events; and executes security testing and assessments The Vice President of Information Technology and Security advises the executive team on the development and implementation of the information security program.


text: The Company incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, the Company has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see " Item 1A. Risk Factors — We face risks related to our information technology systems, including potential cyber-attacks and security and privacy breaches ".


text: The Board and executive team provide regular oversight of the Company's cybersecurity risk management program. The Vice President of Information Technology and Security presents to the Board and the executive team regularly with updates via business review dashboards. The Board and executive team provide guidance, including with respect to any changes to business priorities, risk tolerance, or security initiatives.


text: Risk Management and Strategy Cybersecurity and privacy incidents in the pharmaceutical industry are growing in frequency and severity, prompting organizations to invest heavily in people, processes, and technology to bolster their cybersecurity risk management capabilities.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: We assess the integrity of our information technology and cybersecurity platforms to help ensure proper safety measures are implemented. We understand the extensive responsibility associated with safeguarding our systems and data. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include:


text: Detection and Prevention: We utilize various securities tools and technologies designed to prevent, identify, protect, detect, escalate, respond and recover from cyber threats in a timely manner. Our approach includes real-time monitoring, threat analysis, and regular security evaluations to identify and mitigate potential vulnerabilities.


text: User Training & Education: We realize that human error can be a significant cybersecurity risk, so we have implemented education and training programs for our staff to raise awareness about cybersecurity best practices. By promoting a culture of security consciousness, we empower our staff to identify potential threats and respond effectively, in a way that is designed to enhance the overall cybersecurity posture of our organization.


text: Incidence Response and Business Continuity: We have comprehensive Incidence Response and Business Continuity plans in place designed to ensure the continuity, availability and accessibility of our systems and data, even in the face of unforeseen events such as natural disasters or cyber incidents, which plans and systems we test regularly.


text: We rely upon the capacity, availability and security of our information technology hardware and software infrastructure. We maintain comprehensive compliance and security programs designed to help safeguard and ensure the integrity of the confidential information we possess, which includes both organization and technical control measures. We routinely conduct employee trainings on important information security procedures and test and measure compliance with these security measures. In addition, we maintain cyber insurance policies that mitigate the financial risk of any potential incident.


text: We engage consultants, auditors, and other third parties in connection with such processes. We work with third-party service providers to assist us in our cybersecurity risk management to identify areas that may potentially impact our business, develop and implement control framework to mitigate such cybersecurity risks, and to be prepared to respond to and report (as required) applicable cybersecurity incidents.


text: We face a number of risks including the growing threat of cybersecurity attacks. Despite our implementation of security measures to combat the threats of cybersecurity attacks, any system failure, accident or security breach could result in disruptions to our operations. To the extent that any disruption, cybersecurity attack or other security breach results in a loss or damage to our data or inappropriate disclosure of confidential information, our business could be harmed. In addition, we may be required to incur significant costs to protect against damaged caused by these disruptions or security breaches in the future.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced cybersecurity incidents that have materially affected us, our business strategy, our results of operations or our financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding risks from cybersecurity threats, please refer to "Item 1A. Risk Factors" of this annual report on Form 10-K.


text: Our Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management. This committee periodically reviews and assesses the risk exposure of our risks related to data privacy, technology and information security, including cyber-security, and back-up of information systems and makes recommendations to our Board of Director pertaining to monitoring and minimizing findings in such assessment. This committee periodically reports to the Board of Directors.


text: While the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management, our management also plays an integral role in cybersecurity oversight. Our management is responsible for day-to-day risk management processes. This includes periodic updates from the Executive Director of Information Technology who has over 24 years of work experience in the life science industry, and holds an undergraduate degree in Industrial Technology. The Executive Director of Information Technology is responsible for managing the daily measures of safeguarding the information technology infrastructure from potential threats and vulnerabilities, which includes monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, we have established a Crisis Management Team (CMT), which is a team of cross-functional participants who are prepared to review and assess any potential cybersecurity incidents. The CMT team is led by our CFO and our General Counsel who will advise the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee of the Board accordingly in the event of any incident. We believe this division of responsibilities is the most effective approach for addressing our cybersecurity risks and that the Board leadership structure supports this approach.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy, Written Information Security Policy and Incident Response Plan with Stellus Capital Management (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy also sets forth the role of our Chief Compliance Officer and our Information Security Team in preparing, implementing, and maintaining incident response procedures.

companyName: Stellus Capital Investment Corp

ticker: SCM


text: Our Chief Compliance Officer and Information Security Team are responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. At times we may also engage assessors, consultants, auditors or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of Stellus Capital Management who provide services to us pursuant to the Administration Agreement.


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors," in this Annual Report on Form 10-K under the heading " We, Stellus Capital Management and our portfolio companies are subject to risks associated with "phishing" and other cyber-attacks. "


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Team as needed, but no less frequently than annually. On at least a quarterly basis, the Information Security Team reports to our Board on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and Information Security Team's evaluation of cybersecurity risks that are material to us.


text: Risk Management and Strategy We employ risk management, mitigation and prevention strategies based on frameworks provided by the National Institute of Standards and Technology ("NIST") regulation standards, third party cyber service providers, and common industry practices. These frameworks are applied across all network, hardware, software and communication platforms whether the platform is self-hosted or provided as a service. We leverage a Risk Assessment Score ("RAS") based on these standards against any internal networks, platforms, technologies or initiatives as well as any perimeter or connected partner, vendor or third-party service.


text: Our cyber posture, policies and in-production procedures are designed and developed to manage and minimize risk, threat, or loss to business processing, business objectives and business assets as well as protecting the integrity, confidentiality and personal identifying information ("PII") of our employees and partners.


text: Our security team is intentionally comprised of internal personnel with a range of technical, legal and management disciplines as well as external, third-party cyber service providers, auditors and technical consultants. This allows for broader monitoring, objective reporting, controlled policy, decreased recovery time objectives and quicker incident response.


text: Cybersecurity operations generally fall under the discretion of the IT Director, who has 20 years of experience and is a Certified Secure Infrastructure Specialist (CSIS - Comptia) and IT Operations Specialist (CIOS - Comptia). Our IT Director regularly communicates with and provides relevant cyber reporting, analysis, statistics and statuses to the Chief Financial Officer, who also has a background in IT and is a Certified Information Systems Auditor.


text: Our Cyber Incident Response Plan employs an operational incident-handling capability that includes preparation, detection, analysis, containment, eradication, recovery, and communication procedures.


text: Our cyber policies are based on the National Institute of Standards and Technology 800-171 and CMMC Level 2 framework, requiring formal written policies, procedures, plans of action, general security plans and regular audits. In addition, Southland carries Privacy, Security and Technology Insurance covering incidents and responses related to business interruption, data recovery, data breach, extortion and ransomware, and crisis management.


text: The Company's cybersecurity program, identified events, current and future strategies are presented to the Audit Committee for periodic review. The Audit Committee may choose to present relevant information to our board of directors (the "Board") as deemed necessary.


text: See "Systems and information technology interruption and breaches in data security and/or privacy could adversely impact our ability to operate and negatively impact our results of operations" in "Item 1A. Risk Factors."


text: We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Our cybersecurity program is led by our director of information technology (IT), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our director of IT has extensive information technology and program management experience and leads a team that has many years of experience with our organization. Our director of IT reports to our vice president in charge of coordinating operational activities within our business segments. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews cybersecurity risks at least annually, integrating findings into strategic risk assessments.


text: We continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our director of IT and senior executives including our chief executive officer, chief financial officer and general counsel, and our executive vice president who is also the Contran chief information officer. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT team is responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.


text: The CISO manages the Security Operations Center (SOC) and is responsible for implementing and maintaining controls designed to detect and defend us against cyber-attacks and includes a dedicated function for incident response and ongoing monitoring for cybersecurity threats and vulnerabilities, including those among the Bank's third-party suppliers. The CISO conducts a quarterly review of our inherent risk posture against the effectiveness of our cyber risk management strategies. This review helps in measuring the effectiveness of controls and identifying areas for improvement ensuring cyber controls is commensurate with our inherent risk profile and the Board's risk appetite.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief executive officer and chief financial officer, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.


text: We face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- Risk Factors.


text: Cybersecurity Risk Management and Strategy Allient has processes in place to assess, identify, and manage material risks from cybersecurity threats. We regularly undertake audits and evaluations (including to the National Institute of Standards and Technology (NIST) SP 800-171 standards) and enhance our security framework based upon the results of those audits and evaluations. For new associates, and on an annual basis thereafter, we require associates to take security awareness training and conduct on-going phishing recognition training and testing programs.

companyName: ALLIENT INC

ticker: ALNT


text: We have integrated cybersecurity risk management into our enterprise risk management program, and our management, lead by our Global Information Technology Director, regularly review cybersecurity risks. We rely extensively on information technology ("IT") systems for the storage, processing, and transmission of our electronic, business-related information assets used in, or necessary, to conduct business. We leverage our internal information technology infrastructures, and those of our business partners, to enable, sustain, and support our global business activities. In addition, we rely on networks and services, including internet sites, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third-parties or their vendors, to assist in conducting our business.


text: Numerous and evolving cybersecurity threats pose potential risks to the security of our IT systems, networks and services, as well as the confidentiality, availability and integrity of our technology systems and data. In addition, the laws and regulations governing security of data on IT systems is evolving and adding another layer of complexity in the form of new requirements.


text: Over the last three years, we have experienced no known information security breaches. However, as cybersecurity incidents continue to increase in scope, complexity, and frequency, we may be unable to prevent a significant incident in the future which may materially impact our results of operations.


text: Our cybersecurity program engages third parties when necessary. In the past, we have had cybersecurity incidents and we have made, and continue to make investments, seeking to address these threats, including monitoring of networks and systems, hiring of experts to evaluate and test our systems, employee training and security policies for employees and third-party providers. All third parties that we use have been vetted and have deep experience and strong reputations in the industry. As such, controls from the third-party vendors have been deemed to be adequate prior to any goods or services having been provided.


text: Cybersecurity Governance Management is responsible for the development of all cybersecurity programs, including the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Board receives quarterly reports regarding the overall cybersecurity risk management process. The Board and Audit Committee are responsible for information security oversight. Two members of the Company's Board have relevant information security and cybersecurity experience. As part of their oversight, senior leadership meets with the Audit Committee at least annually to discuss information security and cybersecurity matters.


text: For additional information regarding risks related to information technology and cybersecurity, as well as governance related to managing such risks - see also Item 1.A: Risk Factors.


text: To augment our internal efforts, we engage third parties to conduct independent assessments of our cybersecurity posture. These external assessments provide an objective review of our security controls, breach readiness and compliance with industry standards and regulations. The insights gained from these audits inform refinements to our risk management strategies with respect to cybersecurity-related threats.

companyName: EVgo Inc.

ticker: EVGO


text: Our cybersecurity strategy prioritizes prevention, detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our produced products and related services. We have adopted security-control principles primarily based on the National Institute of Standards and Technology Cybersecurity Framework (NIST). We also leverage industry and government associations, third-party benchmarking, internal and external Company audit results, threat intelligence feeds, and other similar resources to form our cybersecurity processes and allocate resources.

companyName: Amplify Energy Corp.

ticker: AMPY


text: We maintain an information security program that includes physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, while timely and effectively responding to, cybersecurity threats or incidents, including those from third-party service providers who have access to our systems, data or are critical to our continued business operations. Through our cybersecurity risk management process, which is overseen by the Amplify Information Technology Steering Committee (the "Steering Committee"), we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats. This process has been integrated into the Company's Risk Management Program, and we have integrated Cyber Incident Response planning into our Business Continuity Program. In addition, we routinely engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. We provide monthly cybersecurity awareness and weekly phishing simulations, data protection modules, tabletop exercises, as well as more contextual and personalized modules for targeted users and roles.


text: Our Steering Committee was established to further strengthen our cybersecurity risk management activities across the Company, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The Steering Committee has primary management oversight responsibility for assessing and managing risks from cybersecurity threats and is responsible for developing and coordinating enterprise cybersecurity policies and strategies and for providing guidance to key management and oversight bodies. Our Vice President of Information Technology, who has nearly two decades of information technology and cybersecurity risk management experience in the oil and natural gas industry, serves as the chair of the Steering Committee. The Steering Committee includes senior executives and managers, with significant risk management expertise, from multiple areas of the business. The Steering Committee meets quarterly and reports to senior management regarding the progress of specific cybersecurity objectives. Cross-enterprise action teams will be formed, as needed, to manage and implement key decisions of the Steering Committee. A strong partnership exists between our information technology, finance, operations, internal audit, and legal departments for the purpose of addressing identified issues in a timely manner and reporting incidents as required.


text: The Nominating & Governance Committee, which is comprised entirely of independent directors, has primary responsibility for oversight of the Company's initiatives, policies and performance regarding risk management matters, including information security, cybersecurity, business continuity and data protection and privacy. Committee members have extensive experience working for and/or serving on the boards of directors of publicly traded companies and are experienced in overseeing cybersecurity and information security risks, understanding the cybersecurity threat landscape and/or assessing emerging cybersecurity risks. The Nominating & Governance Committee generally meets at least quarterly and as frequently as circumstances dictate. Members of senior management, representing a variety of teams and functions including information technology, operations, finance and legal, routinely provide updates regarding assessments of cyber risks, the threat landscape, and the Company's cybersecurity risk mitigation and governance strategies. The Nominating & Governance Committee and members of senior management brief the entire board, as necessary, on cybersecurity matters discussed during committee meetings.


text: While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we face certain ongoing risks from cybersecurity threats, that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations, and/or financial condition. For more information about these risks, see the risk factor titled, "Our business could be negatively affected by security threats, including cybersecurity threats, destructive forms of protest and opposition by activists and other disruptions" under Item 1A of Part I of this Annual Report.


text: The Information Security Committee ("ISC") is chaired by the CISO and is responsible for overseeing cybersecurity risk, including information security policies and procedures, information security audits, social engineering testing, vulnerability management, penetration testing, information security projects, business continuity, incident response planning, and current threats and security advisories related to the bank's information systems and data assets. The ISC members include the CRO, Chief Information Officer, and General Counsel, with broader attendance from representatives of Risk Management, Technology, Operations, Internal Audit, and Retail. The ISC, in turn, provides a summary update and points of escalation to the Risk Management Committee ("RMC"), who is chaired by the CRO.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: We proactively address cybersecurity risk through a comprehensive cybersecurity program to identify, protect, detect, respond to, and manage any reasonably foreseeable cybersecurity risks and threats. We use a multi-faceted approach including, but not limited to, third-party assessments, internal cybersecurity audits, IT security, governance, risk, and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things, require mandatory third-party cybersecurity training and testing for all employees, perform periodic user access reviews across the organization, perform penetration testing using external third-party tools and techniques to test security controls, employ multifactor authentication and biometrics login tools, take steps to verify whether vendors have appropriate cybersecurity programs, and conduct frequent security assessments to identify and remedy vulnerabilities.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: We also employ the use of Secure Socket Layer inspection on our firewalls, which are able to decrypt and scan all network traffic entering and leaving our facilities. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards, including regularly reviewing and updating our incident response plan. These partnerships enable us to leverage specialized knowledge and insights, seeking to continue to improve upon our cybersecurity strategies and processes.


text: Based upon the information that we have as of the end of the year covered by this report, we do not believe that we have experienced any material cybersecurity incidents to date. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken, and continue to take, to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents, and, as a result, there can be no assurance that we or the third parties we interact with will not experience a cybersecurity event in the future that will materially affect us. As described in Item 1A – "Risk Factors", any breach of data security could result in a disruption of our services or improper disclosure of personal data or confidential information, which could harm our reputation, require us to expend resources to remedy such a security breach or defend against further attacks, or subject us to liability under laws that protect personal data, resulting in increased operating costs or loss of revenue.


text: Our Board understands the critical nature of managing risks associated with cybersecurity threats. Accordingly, our Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and in maintaining shareholder confidence. The Audit Committee has been made primarily responsible for the Board's oversight of cybersecurity risks. However, the entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address these issues. Our Chief Information Officer is responsible for overseeing cybersecurity and reports to the Audit Committee, as well as the Board at all its regular quarterly meetings regarding matters of cybersecurity. These reports include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), updating the status on defensive security measures and risk assessment, and key information security initiatives. Our Audit Committee and our other Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our Chief Information Officer has been with the Company for more than 25 years, developing and overseeing our information systems and cybersecurity risk management program. Our Chief Information Officer and his team, which includes a cybersecurity professional, are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board and Audit Committee on any appropriate items.


text: Cybersecurity risk management is an important and continuously evolving focus for the Company. Resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology assets. The Company's security efforts are designed and tested to protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems or cause other damage. The Company has implemented precautionary measures and controls reasonably designed to address this increased risk, such as enhanced threat monitoring. The Company continues to make investments and partner with qualified third parties to enhance its cyber defense capabilities to monitor the evolving spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency against cybersecurity threats. The Company actively participates in discussions and simulations of cybersecurity risks and has engaged in efforts to educate all employees on the topic of cybersecurity risks.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: The Company acknowledges that third parties and clients may also be sources of cybersecurity risk for the Company. As a result, the Company engages in regular and ongoing reviews and discussions with vendors and clients regarding cybersecurity risks and opportunities to improve the Company's cybersecurity posture. The Company maintains a vendor risk management program to identify and help manage any third party cybersecurity risks.


text: The RMC serves as the primary Management committee in fulfilling enterprise risk management oversight responsibilities, including cybersecurity risk. The RMC provides quarterly updates to the Audit Committee.


text: Additionally, the Company maintains an Information Security Program designed to prevent, detect, and respond to cyberattacks, and maintains a cybersecurity incident response plan designed to enable the Company to respond to cybersecurity incidents, coordinate such responses with law enforcement and other government agencies, and notify clients and customers, as applicable. The Company's risk and technology teams, led by the Company's Chief Risk Officer ("CRO") and Chief Technology Officer ("CTO"), respectively, are responsible for leading the incident response team, identifying technology and cybersecurity risks, utilizing management's expertise in assessing the materiality of cybersecurity events, and are responsible for the controls to manage threats. The Company's risk team in conjunction with the broader incident response team conduct periodic tabletop exercises and business continuity simulations to train and align on best practices and assessment of potential cyber events. Management utilizes the incident response plan and incident response team to assesses materiality of any cyber event through a qualitative and quantitative assessment. The information security program and overall cybersecurity risk management processes are aligned and integrated into the Company's overall risk profile and appetite through the Company's Enterprise Risk Management Committee.


text: The Company's governance structure is designed to identify, escalate, and mitigate information security risks. Management utilizes its Enterprise Risk Management Committee and IT Steering Committee, comprised of senior leaders including the Company's CRO, CTO, Chief Financial Officer, and other leaders with cybersecurity expertise, to disseminate information and monitor information security efforts throughout the Company. Each committee's charter, in addition to the Information Security Policy, establishes roles and responsibilities related the Company's cybersecurity governance and program. The risk team provides oversight of the Company's activities designed to identify, assess, measure, and mitigate cybersecurity risk. The Company's Information Security Program includes training that reinforces the Company's Information Security Program policies, standards, and practices, as well as the expectation employees comply with these policies. The technology team engages employees through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees, and is supplemented by various testing initiatives, including social engineering testing. Finally, the Company provides specialized security training for certain employee roles such as system administrators and all information security training is monitored and reported on by the risk team as well as the Company's learning and development function.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks faced by the Company. In addition, our board of directors, as a whole and through its Audit Committee, is responsible for the oversight of cybersecurity risks. In that role, the board of directors and Audit Committee are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, the board of directors and Audit Committee receive periodic updates on the Company's Information Security Program, cybersecurity policies and practices, ongoing efforts to improve security, as well as the Company's efforts to prevent, detect, mitigate, and remediate significant cybersecurity incidents.


text: Risks from cybersecurity threats, including any previous cybersecurity events, did not materially affect the Company or its business strategy, results of operations or financial condition during the period covered by the report. Notwithstanding the comprehensive approach that the Company takes to address cybersecurity risk, the Company may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.


text: Our business operations rely on the secure collection, storage, transmission, and other processing of confidential and sensitive data through our information systems. In addition, as a financial services company, we are subject to extensive regulatory compliance requirements concerning the treatment of such data. To ensure the security, confidentiality, integrity, and availability of our information systems, we have implemented a comprehensive cybersecurity risk management program (the "Information Security Program"). The program is designed to identify, assess, manage, and mitigate risks and secure Company and customer information against threats. This is achieved through monitoring, threat management strategies, policies and procedures, security awareness, oversight, and governance.


text: The Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO") provide direct oversight and management of the cybersecurity risk management program. The CISO and the Information Security team assess and manage the day-to-day cybersecurity and threat management programs. Our CISO has more than 20 years of relevant experience in leading and building risk management and cybersecurity programs. Our CISO maintains the following credentials: Certified Information Systems Auditor and Certification in Risk Management Assurance. The CRO and CISO report periodically on important updates related to the Information Security Program and threat landscape to the Board of Directors and its designated committee with responsibility for oversight of risk management.


text: There are also several Management committees that are responsible for oversight of the Information Security Program. These include: • Information Security Committee; and • Risk Management Committee.


text: This multi-layered approach has been integrated into the Company's overall risk management system and processes. Integrating cybersecurity risk management into the overall risk management system demonstrates the Company's commitment to addressing threats that could significantly impact its operations, financial stability, and reputation. This integration is intended to provide a holistic approach to risk management and helps in creating a more resilient organization against cybersecurity threats.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: The Board of Directors holds oversight responsibility over the Company's risk management program, including material risks related to cybersecurity threats. This oversight may be executed directly by the Board of Directors or through its committees. The Board of Directors has delegated oversight of Risk Management to the Audit Committee of the Board of Directors. The Audit Committee engages in regular discussions with Management regarding the Company's risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include evaluating current trends, internal risk assessments, and risk management policies. Annually, a comprehensive report on the state of the Information Security Program, including cybersecurity risk management, is provided to the Board of Directors by the CRO and CISO. This report includes: Risk assessment results; Third- and fourth-party vendor oversight; Results of security monitoring and testing; Security incidents or violations (if applicable); Internal and external audit results.


text: Cybersecurity Risk Management The Information Security Program employs various information security controls, tools, and strategies to combat threats and to ensure the Company's information and systems remain secure. The Information Security Program contains specific provisions for identifying, assessing, and mitigating cyber threats, including but not limited to ransomware attacks, denial of service attacks, phishing and social engineering, data breaches, credential theft, and vulnerability exploitation.


text: Due to the dynamic nature of risks, threats, vulnerabilities, and the information systems themselves, all information systems that store, process, or transmit sensitive and confidential information are protected by comprehensive defense-in-depth strategies that include strong authentication techniques, firewalls, intrusion detection systems, end point protection, physical security measures, encryption and security awareness training.


text: The Information Security Program is periodically reviewed to ensure that internal controls are designed appropriately and operating as expected. The Information Security Program is reviewed and approved by the Board of Directors annually. Periodic audits are performed by internal and external auditors to confirm adherence to the security program and regulatory guidelines and requirements. The Information Security team performs an annual assessment of cybersecurity risk and maturity using the FFIEC Cybersecurity Assessment Tool and reports the results to the Board of Directors as part of the annual report.


text: The Information Security Program complies with all applicable regulations, including Section 501(b) of the Gramm–Leach–Bliley Act and Section 216 of the Fair and Accurate Credit Transactions Act of 2003. The Information Security Program aligns with National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security (benchmarks for device hardening).


text: The Information Security team is responsible for monitoring and identifying all vulnerabilities and suspected threats and implementing corrective actions, if required. The Information Security team conducts risk assessments on the technology stack, determines effectiveness of internal controls, and develops remediation plans. The Information Security team utilizes specialized service providers to perform continuous monitoring, alerting and containment of potential threats, and penetration testing. The Information Security team maintains a Vendor Management Program and performs ongoing periodic risk assessments on third- and fourth-party vendors and their associated technologies, if applicable.


text: While we have not experienced any data breaches during the year, our online banking platform was targeted in the beginning of the year by threat actors who created malicious look-alike phishing sites. The Bank did not suffer losses as a result of these attempted attacks and due to efforts made to improve our security posture, the attack efforts have significantly subsided and remained at a stable low-level for the remainder year. We continue to monitor and look for ways to enhance security, safeguard customer data, ensure the continuity of our operations, and mitigate any risks associated with potential cybersecurity events.

stage1Category: Incident Disclosure


text: The Information Security team maintains a Third-Party Risk Vendor Management Program that requires all third-party vendors with access to our systems or sensitive information comply with applicable cybersecurity standards and regulations. Ongoing periodic risk assessments on third- and fourth-party vendors and their associated technologies are performed, if applicable.

stage1Category: Third-Party Risk


text: While extensive cybersecurity controls and procedures are in place, the risk of experiencing an incident can never be eliminated completely. We maintain and regularly review and update an Incident Response Plan that outlines procedures for identifying, containing, and mitigating any cyber event that may affect our systems, data, or operations and includes potential credit monitoring services, customer and regulatory notification guidelines and templates. This plan is regularly tested and updated. The plan is designed to address adverse events that could impact the security of information, that affect our ability to conduct secure financial transactions, or that present reputational risk. We have retainers in place with privacy counsel and forensic incident response firms.


text: We maintain cybersecurity insurance coverage to mitigate potential financial impacts from cyber incidents, such as data breaches and system disruptions. However, such insurance may not cover all types of damages, and we cannot guarantee that our coverage will be sufficient to fully protect us from the financial consequences of a cyberattack.


text: The Company is committed to maintaining a strong cybersecurity posture devoting significant resources to cybersecurity and risk management processes to adapt to the rapidly evolving landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company has designed and implemented cybersecurity policies and procedures for identifying and managing material risk from cybersecurity threats, both internally and related to the use of third-party service providers. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular basis. At the tactical level, our information technology (IT) security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The Company monitors and evaluates our cybersecurity position and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Additionally, the Company maintains a formal information security training program for all employees that includes training on matters such as phishing, email security best practices and data privacy. To evaluate and enhance our cybersecurity program, it is regularly evaluated by external experts with the results of those reviews reported to senior management and the Audit Committee of our Board of Directors (Audit Committee). We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Mayville Engineering Company, Inc.

ticker: MEC