text: We also have policies and procedures to oversee and identify the risks from cybersecurity threats associated with our use of third-party service providers. Our third-party service providers provide us with SOC-1 reports, which document their internal controls, on a regular basis. Our executive management team reviews these reports as part of its assessment of the effectiveness of our internal control over financial reporting. We use such reports to assess and mitigate the risks associated with the use of third-party providers.


text: To date, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation, cause existing customers to discontinue purchasing our products, prevent us from attracting new customers, interfere with our efforts to pursue regulatory approvals for our product candidates, or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. For further information, see "Risk Factors— Cyberattacks and other data security breaches could compromise our proprietary and confidential information, which could harm our business and reputation or cause us to incur increased expenses to address any such breaches. " in Item 1A of this Annual Report on Form 10-K. We have attempted to preemptively mitigate the financial impact of any cybersecurity incident and currently maintain limited cyber liability insurance. However, our cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our cyber liability insurance may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.

companyName: Petros Pharmaceuticals, Inc.

ticker: PTPI

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: 5&2 Studios, Inc.


text: We are a SPAC with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable target businesses. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Angel Studios, Inc.

ticker: ANGX

stage1Category: None/Other

stage1Method: majority


text: We recognize the critical importance of maintaining the trust and confidence of business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks by utilizing reputable third party vendors and service providers to manage and maintain our information systems and assets in accordance with strong cybersecurity policies, standards, processes and practices, and by preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TAO Synergies Inc.

ticker: TAOX

stage1Category: Risk Management Process


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain policies to ensure our systems are effective and prepared for information security risks. For example, our Synaptogenix Information Security Policy, which applies to all employees, contractors and third parties granted access to our systems and provides guidelines for maintaining information security, including safeguarding personal and company-issued digital devices, learning to detect phishing and other attacks, restricting data transfer, and ensuring the judicious use of the internet and social media. We also maintain a more general Risk Management Strategy that sets forth our procedures for identifying, assessing, responding to, monitoring, and reporting risks, including any cyber-related risks.


text: Our approach to addressing cybersecurity threat risks also includes mitigating risk associated with our use of third-party service providers. For example, when we enter into contracts with third-party collaborators or vendors pursuant to which sensitive business or personal data will be shared or accessible, we include provisions safeguarding the protection of confidential information. We also utilize a third party service provider to maintain our information systems and assets and to employ technical safeguards that are designed to protect our information systems from cybersecurity threats.

stage1Category: Third-Party Risk


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. We maintain an Information Security Incident Response form that directs a detector of any incident to report such incident to our Information Security Officer, whom we contract through a third party service provider. Following notice of any such incident, our Information Security Officer would then work with our Chief Financial Officer and our Board to establish an appropriate response plan and to determine the materiality of the incident and any disclosure obligations.


text: As discussed in more detail under "Cybersecurity Governance" below, our Board provides oversight of our risk management and strategy processes.

stage1Category: Board Governance


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is part of our overall risk management processes. In general, our Board oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Any cybersecurity incident that occurs would be brought to the immediate attention of the Board.


text: Cyber partners are a key part of our cybersecurity infrastructure. KULR partners with leading cybersecurity companies, leveraging third-party technology and expertise. KULR engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in KULR's environment.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by a contracted third-party Information Security Officer. Such individual has over 25 years of experience in information technology, including over 14 years of experience in cybersecurity, and has a master's degree in cybersecurity. Our Information Security Officer is informed about and monitors our cybersecurity risk through his participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

stage1Category: Management Role


text: Cybersecurity Risk Management and Strategy We understand the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Certain cybersecurity processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated into our operations as a part of our overall risk assessment process.

companyName: Transcode Therapeutics, Inc.

ticker: RNAZ


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party computer support firm to assist with network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.


text: Since July 2021, we have no knowledge of any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our third-party CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our current or future therapeutic candidates' development programs," and "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," for additional discussion about cybersecurity-related risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes. Our Chief Financial Officer is the primary person in our company responsible for overseeing the cybersecurity risk management program. He has had oversight of our cybersecurity and risk management programs since the second half of 2021. This is not a full-time function for our Chief Financial Officer and because he is not an experienced computer professional, he relies to a large degree on our outside information technology, or IT, support firm. He is also immediately alerted of any cybersecurity breaches that occurs by our third-party vendors or by others so that appropriate measures may be taken timely.


text: Our Board of Director's role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks. The Board conducts its risk oversight by receiving reports from our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats.


text: Cybersecurity Risk Management We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for the oversight of risks from cybersecurity threats, if any. Information regarding any cybersecurity incidents would be shared with our board of directors or audit committee to enable assessments related to disclosure and notice requirements. We have not encountered any cybersecurity incidents since our IPO.

companyName: Churchill Capital Corp VII


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls, and information systems. On a regular basis, we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify and manage material risks. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we:


text: Conduct periodic vulnerability assessments and mitigate vulnerabilities for our systems and processes that include sensitive data Conduct regular security awareness trainings and phishing simulation attacks Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident and Perform periodic gap analyses to review our cybersecurity controls for gaps and implement the closure actions.


text: To date, we have not experienced any cybersecurity incidents that have had a material impact on our service, systems, business, financial condition, or results of operations. Any significant disruption to our service or access to our systems could adversely affect our business, results of operation and reputation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. See "Risk Factors – Cybersecurity – Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, including corporation information, or theft of intellectual property, including digital content assets, which could adversely impact our business." Management has implemented risk management structures, policies, and procedures, and manages our risk exposure on a day-to-day basis. We have a cybersecurity organization within our operations department that focuses on current and emerging cybersecurity matters and leverages cybersecurity consultants and third-party cybersecurity firms.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats for our Company, if any, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: CORNER GROWTH ACQUISITION CORP. 2


text: Risk Management and Strategy Our company recognizes cybersecurity as a critical component of its risk management strategy. We are committed to protecting our digital assets, customer data, and intellectual property from cyber threats. Our approach is guided by industry best practices and compliance with relevant cybersecurity standards and regulations including SOC 2, ISO 27001, and ISO 27701. We conduct regular assessments to identify potential cybersecurity threats and vulnerabilities that are then reviewed by external auditors as part of our annual SOC 2 Type 2 Review and ISO 27001 audit. This process includes evaluating external threat landscapes, internal systems, and processes for susceptibility to cyber-attacks. We utilize both in-house expertise and external consultants to ensure a comprehensive assessment. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Moatable, Inc.

ticker: MTBLY


text: Our information technology department collaborates with our security and compliance team (a cross-functional team), product development department and the legal department to help identify, assess and manage the company's cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile, using various methods including, among others, manual and automated tools, internal and external audits, third-party threat assessments and external intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including but not limited to IT policies (incident management plan, stake-holder engagement, incident response plan, DR plan, etc.) incident detection and response, and vulnerability detection and management, preventative controls including firewalls, secure coding practices and IDS, annual disaster recovery testing, data segregation and encryption (at rest and in-transit), network security controls and access controls, asset management, tracking and disposal, vendor management, employee training and awareness and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the information technology department, security and compliance team and product development department work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and our senior management, such as our chief executive officer, evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our board of directors, which evaluates our overall enterprise risk.


text: Additionally, we use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Such third-party service providers include professional service firms including outside legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services providers, and forensic investigators. These third-party service providers perform a variety of functions for our company, and we maintain a robust vendor management program to manage cybersecurity risks associated with our use of these providers. For example, we conduct risk and security assessment for potential vendors and their programs and periodically review such assessments; and we require our vendors to complete security questionnaires and conduct audits and vulnerability scans related to them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect our company, see "Item 1A. Risk Factors—Risks Related to Our Business and Industry—Cyber-attacks, computer viruses, physical or electronic break-ins or other unauthorized access to our or our business partners' computer systems could result in misuse of confidential information and misappropriation of funds of our customers, subject us to liabilities, cause reputational harm and adversely impact our results of operations and financial condition.," and "—We rely on sophisticated information systems and third-party cloud infrastructure to run our business. The failure of these systems, any service disruptions or outages, or the inability to enhance our capabilities, could have a material adverse effect on our business, sales, and results of operations."


text: Our board of directors recognizes the critical importance of cybersecurity in safeguarding our company's assets, reputation, and customer trust. Our board of directors addresses our company's cybersecurity risk management as part of its general oversight function.


text: The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management members, including Mr. Henry He Li, our chief technology officer, Chris Williams (SecurePoint 360), our virtual chief information security officer, and Mr. David Rice, our global IT manager.


text: Our cybersecurity incident response policy and vulnerability management policy are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our chief technology officer. These management members work with related incident response functions, including the information technology department, the product development department and the legal department, to help the company mitigate and remediate cybersecurity incidents of which they are notified.


text: In addition, our company's incident response policy and vulnerability management policy include reporting to the audit committee of the board of directors for certain cybersecurity incidents. Our audit committee receives periodic reports from our information technology department concerning the company's significant cybersecurity threats and risk and the processes the company has implemented to address them.


text: Artificial Intelligence AI possesses the potential to transform various work sectors significantly. Currently, we are in the early stages of enhancing and broadening our offerings with AI technologies, aiming to assist our clients in tackling current challenges. Our dedication lies in actualizing AI's potential while ensuring ethical practices. Our approach is underpinned by fundamental values: ensuring equity, dependability, and safety, maintaining privacy and security, promoting inclusiveness, upholding transparency, and embracing accountability.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in "Item 1A. Risk Factors" of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in "Item 1A. Risk Factors" of this Form 10-K.

companyName: Coliseum Acquisition Corp.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our customers, suppliers and subcontractors face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.


text: KULR's Chief Technology Officer ("CTO"), in conjunction with our third-party providers, is responsible for assessing and managing KULR's cyber risk management program, informs senior Management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervises such efforts.


text: We deploy online cybersecurity training for employees and consider this a critical step in safeguarding the Company's data and assets. The training provides employees with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The training techniques to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide include insider attacks, phishing and email attacks and data protection. Employee completion of cybersecurity training is tracked and monitored via an online administrative portal.


text: The Board of Directors oversees Management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management regularly briefs the Board of Directors on our cybersecurity and information security posture, and the Board of Directors is apprised of cybersecurity incidents at quarterly Board of Directors meetings.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology ("IT") environment and customer-facing products. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We conduct an annual assessment of our practices and standards against the NIST CSF.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, risk and compliance reviews, and regular meetings with KULR executives. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform vulnerability testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and may continue to experience, cyber incidents in the normal course of our business. Although prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, there can be no assurance that we will not suffer a material loss in the future. For a description of the risks from cybersecurity threats that may materially affect the Company, see our risk factors under Item 1A. Risk Factors, including Significant disruptions of information technology systems, breaches of data security and other incidents could materially adversely affect our business, results of operations and financial condition.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this report.

companyName: Chenghe Acquisition I Co.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: Global Lights Acquisition Corp


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. As of the date of this report, we have not encountered any cybersecurity incidents since our IPO.


text: Mobile device management software monitors security events via a Security Information and Event Management platform, managed by a detection and response provider. Mobile device management software is employed with the objective of protecting corporate email and data on mobile devices and is designed to prevent unauthorized data transfer.

companyName: BF Garden Tax Credit Fund IV L.P.


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. However, we do depend on the digital technologies of third parties, including information systems and infrastructure, and as noted in Item 1A. Risk Factors of this Annual Report on Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: Everest Consolidator Acquisition Corp


text: Our board of directors oversees risk for our Company. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our IPO.


text: Risk management and strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Summit Healthcare REIT, Inc


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Audit Committee provides regular updates to the Board of Directors on such reports.


text: Prior to the consummation of our Business Combination on February 9, 2024, we had no business operations and Quantum was a special purpose acquisition company with no business operations. Since Quantum's IPO, its sole business activity has been identifying and evaluating acquisition transaction candidates. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management oversees the assessment and management of cybersecurity threats. In the event of any reportable cybersecurity incident, our management shall promptly notify our board of directors, including determining the necessary actions such as disclosure, mitigation, or other appropriate responses. Quantum has not encountered any cybersecurity incidents since its IPO.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: Cybersecurity Risk Management We maintain written policies and procedures that outline the Company's comprehensive information security program (CISP). The Chief Information Security Officer (CISO) has the responsibility for implementation and maintenance of the CISP. In addition to SEC and FINRA regulatory requirements, we leverage established security frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as guides to continually improve our policies and procedures. In addition, our employees are required to complete a cybersecurity training program each year, which is supplemented with additional awareness efforts, including phishing campaigns and informational notifications.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: We employ a variety of security tools and components to monitor, identify and block cybersecurity threats. In the event of a cybersecurity incident, the Company has an incident response team (IRT) whose role is to respond quickly and effectively. The IRT utilizes an incident response plan for the implementation of the [its] incident response capabilities that provides (i) a definition of "reportable incidents/events", and (ii) "metrics" for evaluating the IRT's response capabilities and effectiveness. The checklist is periodically reviewed by the IT Department for lessons learned from both mock and actual incidents, and to assure compliance with most current industry best practices and latest regulatory developments. The incident response plan includes processes through which cybersecurity incidents are escalated to the Company's executive officers. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises at least annually. These exercises are conducted by internal personnel.


text: Cybersecurity Committee The mission of the Cyber Security Committee is to be responsible for the cultivation of a corporate culture that recognizes risk awareness and the development of the Company's cyber security solutions, utilizing thought leadership, technology and systems, and development of applicable policies and procedures. Through its cyber security policy and procedures, the Committee will ensure effective collaboration and coordination between affected departments and staff in identifying and responding to both privacy and cyber security risks and events. The Committee will oversee the development and implementation of an enterprise-wide strategic framework related to the identification and prevention of cyber security threats as an integral part of the Firm's risk management process, otherwise known as CISP. The Firm's cyber security framework is intended to be "evolutionary", requiring (i) periodic reviews, and (ii) testing of systems, that result in changes to Company policy and procedures, as cyber security issues and developments require. The Committee shall be composed of specified members of senior management, department heads and staff, who have been selected based upon their backgrounds and experience involving IT, Risk Management, Operations, Compliance, and Legal. The Committee shall have the discretion to engage and utilize the services of independent vendors, computer service providers (eSP's) and consultants having expertise in the area of cyber security and IT. The Committee shall determine its meeting agendas and frequency of meetings which shall be reported through minutes prepared by the designated secretary.


text: Engagement of Third Parties We engage third-party subject matter experts and consultants to conduct evaluations of our security controls, including, but not limited to, penetration testing, auditing of our CISP or consulting on our response to cyber security threats and breaches. Results of these evaluations are used to help determine priorities and initiatives to improve the overall CISP. As necessary, we also engage third-party experts and consultants to assist with the incident response process to augment our internal security operation center team.


text: The Company will conduct initial and ongoing due diligence of each current or prospective third-party service provider to evaluate whether the third-party service provider will have access, maintain, or store any client private information. Vendor cybersecurity controls are then assessed to determine if the vendor's control environment meets the Company's standards. Vendors are also assessed on a periodic ongoing basis according to their risk classification.


text: We have not identified any cybersecurity incidents that individually, or in the aggregate, have materially affected or are reasonably likely to materially affect the Company. Regardless, we recognize cybersecurity threats are ongoing and evolving, and there can be no guarantee that we will not be subject to a cybersecurity incident that has a material effect on our business.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors," in this Report. We maintain a cyber liability insurance policy. However, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.

companyName: TECHPRECISION CORP

ticker: TPCS


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a business combination. However, because we have investments in our trust account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Distoken Acquisition Corp


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Cycurion, Inc.

ticker: CYCU


text: We maintain robust and comprehensive processes, procedures and controls to protect and secure our information systems and data infrastructure from cybersecurity threats. Our cybersecurity program is led by our Vice President of Technology, who functions as our chief information security officer (" CISO "). Our cybersecurity program interfaces with other functional areas within the Company, including but not limited to our business segments and information technology (" IT ") and legal departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments. We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the International Organization for Standardization (" ISO ").

companyName: Reservoir Media, Inc.

ticker: RSVR


text: Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate our employees regarding cybersecurity. The CISO also manages our Incident Response Team, which includes a team comprised of executives from various cross - functional management teams, internal technical support roles and external third - party service providers. The Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third - party service providers based on type and severity of the specific incident.


text: We also require cybersecurity training for relevant employees, focusing on the appropriate protection and security of confidential company and third-party information. The IT team provides regular updates to senior management on various cybersecurity threats, assessments and findings and effectiveness of the Company's cyber risk management program. Our Board of Directors through the Audit Committee oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: As of the date of this Form 10 - K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10 - K. However, the sophistication of cyber threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further action, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate to take. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: We believe cybersecurity is critical to us because we are conducting material operations. Cybersecurity threats have not affected our business strategy or results of operations. The Board of Directors will continue to assess the potential threat to future operations as such operations develop. The Board of Directors will oversee management's processes for assessing, identifying and mitigating risks, including cybersecurity risks, to facilitate mitigating our risks involved with cybersecurity and help align our risk exposure with our strategic objectives. The Board relies on its executive officers to identify cybersecurity risks and retains oversight of cybersecurity. In the event of an incident, we intend to take appropriate steps from incident detection to mitigation, recovery and notification of appropriate parties. Management is responsible for day-to-day monitoring of cybersecurity, including detection and response and to report risks and incidents to the Board of Directors. We rely on computer software provided by third parties to protect our computer systems against cybersecurity threats.

companyName: SUNRISE REAL ESTATE GROUP INC

ticker: SRRE


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a Business Combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Newbury Street Acquisition Corp

ticker: NBST


text: As an externally managed company, our day-to-day operations are managed by BFIM, under the supervision and with the participation of the Principal Executive Officer and Principal Accounting and Financial Officer. Our business is highly dependent on the communications and information systems of BFIM, its affiliates and third-party service providers. BFIM is an affiliate of ORIX Corporation USA ("ORIX USA"), a diversified financial company and a subsidiary of ORIX Corporation ("ORIX") and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and BFIM relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.


text: To date, Cybersecurity threats, including any previous Cybersecurity incidents, have not had a material impact nor, are they anticipated to significantly affect the Assignor Limited Partner, including our business strategy, results of operations or financial condition.


text: Cybersecurity Governance The Fund, under the supervision and with the participation of the Principal Executive Officer and Principal Accounting and Financial Officer, is responsible for directing and overseeing our risk management. The Principal Executive Officer and Principal Accounting and Financial Officer administers this oversight function directly. In particular, the Principal Executive Officer and Principal Accounting and Financial Officer has the responsibility to consider and discuss our major financial risk exposures and the steps BFIM takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. The Principal Executive Officer and Principal Accounting and Financial Officer also monitors compliance with legal and regulatory requirements.


text: BFIM is responsible for identifying, assessing, and managing the Assignor Limited Partner's material risks from cybersecurity threats. BFIM relies on ORIX USA and the ORIX USA information and security team, including the ORIX USA CIO, to provide us with a comprehensive cybersecurity risk management program.


text: Periodically, at least annually, ORIX USA's CIO and/or other members of the ORIX USA information and cybersecurity team will present to BFIM on various topics relating to ORIX USA's technology risks, including ORIX USA's cybersecurity program (including the results of cybersecurity tabletop exercises), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes and geopolitical cyber threat management) and risk management (including the results of periodic technology audits).


text: Cybersecurity Risk Management and Strategy ORIX USA has a Chief Information Officer (the "ORIX USA CIO"), who leads an information and cybersecurity team (the "ORIX USA information and cybersecurity team") responsible for managing information security at ORIX USA's asset management business, including its Cybersecurity strategy and program, which encompasses annual employee training about Cybersecurity risks and new employee onboarding about ORIX USA's security policies. The ORIX USA information and cybersecurity team's responsibilities cover three main areas: (i) operations and engineering, (ii) threat detection and response, and (iii) governance. The team comprises members with diverse and relevant skill sets and expertise. The ORIX USA CIO leads the cybersecurity team with over twenty years of experience at ORIX USA and prior experience as a principal with a large management consulting firm. This team has developed a program aligned with the NIST CSF framework, emphasizing training and development, with team members holding industry-recognized certifications complemented by industry-recognized third-party providers for threat and incident management.


text: ORIX USA employs a 'defense in depth' cybersecurity strategy and program based on the NIST Cybersecurity Framework, which includes multiple layers of security policies, protections, and controls designed to safeguard the confidentiality, integrity, and availability of infrastructure, network and information assets from malware and threats. This includes the deployment of firewalls, email protection technologies and web gateway, antivirus, and endpoint detection and response ("EDR") systems.


text: Our firewalls (intrusion detection systems and intrusion prevention systems) are designed to secure the organization's perimeter complemented by an antivirus and EDR platform designed to detect malware and threats on systems. Web application firewalls are designed to protect external facing applications, while our email security gateway utilizes machine learning and multilayered detection techniques designed to filter malicious emails.


text: ORIX USA maintains a Cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of Cyber Incidents. The plan and run books are tested annually through Cybersecurity tabletop simulations where incident response technical, and executive team members go through real-world scenarios focused on current Cyber threats. ORIX USA's Cybersecurity incident response plan provides for escalation of identified Cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of Cybersecurity threats and incidents, assessment of Cybersecurity risk profile or certain newly identified risks relevant to our company, and evaluation of the adequacy of our Cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when the notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including BFIM and the Principal Executive Officer and Principal Accounting and Financial Officer of the Assignor Limited Partner.


text: We have no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Papaya Growth Opportunity Corp. I


text: Our business is not dependent on the internet. Accordingly, we believe that the Company has minimal risks related to cybersecurity. Developing a program to identify, detect, prevent and remediate potential cybersecurity vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. Management believes that the minimal risk does not justify the significant expense needed to develop a program which will identify, detect, prevent or remediate cybersecurity risks.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: During the year ended March 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: The Company has cybersecurity risk management processes, including physical, technological and administrative controls, intended to protect the confidentiality, integrity and availability of the Company's information technology infrastructure and systems or any information residing therein. The Company relies on third party service providers to operate, maintain and monitor its information technology infrastructure and systems and to assess, identify and manage material risks from cybersecurity threats with respect thereto. The Company's management monitors its service providers. The Company's service providers are tasked with notifying the Company's management of any material cybersecurity incident that negatively impacts the Company's information technology infrastructure and systems or any information residing therein. Material and potentially material cybersecurity incidents would be assessed by the Company's executive officers for remediation and future prevention and detection.

companyName: AMREP CORP.

ticker: AXR


text: Notwithstanding the Company's processes for assessing, identifying and managing risks from cybersecurity threats, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. During 2024 and 2023, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: The Board of Directors of the Company oversees the Company's risk management program as part of its general oversight function. The Board of Directors has delegated to the Audit Committee of the Board of Directors of the Company the responsibility for reviewing and discussing with management the Company's policies with respect to risk assessment and risk management and for reviewing contingent risks that may be material to the Company, including cybersecurity risks. The Audit Committee engages in regular discussions with the Company's executive officers regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks, including cybersecurity risks. The Audit Committee also reports relevant material information regarding any such risks to the Board of Directors. The Company's executive officers are responsible for identifying and assessing material risks for the business on an ongoing basis, including cybersecurity risks. Although the Company's executive officers do not have cybersecurity expertise, their experience managing the Company, which includes consulting and coordinating as necessary with its service providers, enables them to effectively assess and manage material risks from cybersecurity threats.


text: Our Chief Executive Officer is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from our IT staff and third-party service providers. Our IT staff at both Ranor and Stadco oversee their respective cybersecurity processes on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above, and escalate matters to our Chief Executive Officer as appropriate.


text: Risk Management and Strategy We maintain high standards with respect to cybersecurity, in accordance with regulatory guidelines, contractual requirements and industry practices. Our cybersecurity strategy is aimed to anticipate, detect, and respond to threats, ensuring the resilience and integrity of our operations. We use a risk management process, overseen by our Information Security Officer ("ISO"), that encompasses technical security controls, policy compliance mechanisms, monitoring systems, contractual agreements, and governance. Our cybersecurity risk management process is integrated with our overall enterprise risk management process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational and financial risk areas. Key elements of our cybersecurity risk management program include a cybersecurity incident response plan with procedures for responding to cybersecurity incidents and annual data protection and cybersecurity awareness training of our employees who have access to information systems.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: We have implemented security control principles that follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework with the main goal of our cybersecurity risk management process being to protect the confidentiality, integrity, and availability of our information assets. Our external auditors annually review our information security management system, which has an ISO/IEC 27001 certification.


text: We monitor our environment for cybersecurity threats with real-time ability to activate measures to minimize impact, respond to incidents, and investigate issues. We routinely conduct security assessments of our applications, manage vulnerabilities, and perform penetration testing as well as exercises that mimic cybersecurity incidents to evaluate and enhance our security posture and lower cybersecurity risk. In addition to our own systems and technology, we rely on third-party service providers for certain software, technology and cloud-based systems and services that support a variety of critical business operations. We have policies and processes designed to identify, assess and manage cybersecurity risk relating to these third-party service providers. When contracting with these providers, the procurement function works closely with the compliance and legal teams to conduct diligence and help appropriately manage risk, including cybersecurity risk, throughout the life cycle of the contract. We have developed, and seek to incorporate, standard contractual security requirements into our service provider agreements. We also perform cybersecurity assessments of third-party service providers where we deem appropriate given the nature of the engagement and the data and systems expected to be accessed.


text: We have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial situation. However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident or will not experience a cybersecurity incident in the future. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Several members of the Board comprise the Risk Management Committee (RMC), which is responsible, among other things, for oversight of cybersecurity risks based on the authority given by our Board of Directors. The RMC receives regular updates at least quarterly from management, including our Chief Information Officer (CIO) and our Information Security Officer (ISO) with evaluations of cyber risk, the threat environment, updates on incidents, and advancements on investments in cybersecurity risk reduction. Our CIO has been with the Company since January 2021 and has over 25 years of global experience. He has served in numerous senior leadership positions where he gained significant cybersecurity and risk management experience across multiple high-tech industries. Our ISO has been with the Company since July 2018 and similarly has over 25 years of extensive cybersecurity, risk and compliance experience including CISSP and CISM certifications.


text: Information Security, Corporate Audit, Finance, Legal, Compliance and Investor Relations have a strong partnership at the management level and have established a Cybersecurity Council that connects the risk management and cybersecurity incident response processes. In the event of a cybersecurity breach, the ISO will inform the Cybersecurity Council, and then the Cybersecurity Council will determine materiality and next steps. The Cybersecurity Council will meet with the RMC and/or the full Board as needed to share details of the event and facilitate reporting to regulators as required.


text: Cybersecurity Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We and our subsidiaries currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. Our IT staff along with the third-party providers and outsourced IT services monitor and address cybersecurity related risks, including installing software for threat protection and malware. Our IT staff and such third-party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate.


text: We continue to work with outside counsel and third - party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Our Chief Executive Officer provides periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.


text: Risk Management and Strategy We maintain a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity and availability of our information systems. Dedicated security and information governance and compliance professionals administer the program with oversight by our senior management team.

companyName: AECOM

ticker: ACM


text: We utilize a combination of technology controls, service providers, and processes to actively monitor and protect our network and systems. All employees are required to participate in a number of information security training and awareness programs on an annual basis, which include training on how to identify and report cyber risks and events.


text: We engage industry cybersecurity experts to evaluate and review our cybersecurity programs. These external reviews include regular audits, threat assessments, vulnerability scans, simulated attacks and other advice regarding information security practices. We regularly conduct incident response exercises with key stakeholders.


text: To manage risks associated with third-party service providers, we typically perform a cybersecurity assessment on new vendors before they are onboarded as a supplier. We conduct periodic reviews of these vendors to evaluate continued compliance with our policies and standards. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry practices, applicable laws and our policies. We rely on vendors to notify us in a timely manner of significant cybersecurity incidents, by virtue of the documents governing their relationship with us or applicable law.


text: Our Board of Directors ("Board") receives regular updates from management and external consultants which may address a broad range of cybersecurity and IT topics, including trends, regulatory developments, data security policies and practices, cybersecurity incidents, and ongoing efforts to further strengthen our security posture. Our Board reviews key metrics related to cybersecurity on a quarterly basis, and is notified of applicable cybersecurity incidents if and when they occur.


text: The Chief Information Security Officer ("CISO") heads the cybersecurity program which includes personnel based in several of our global locations. Our CISO brings over 25 years of experience, which includes both consulting and practitioner roles, and maintains the following certifications: Certified Information System Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), and Certified Information Security Manager (CISM). Our CISO reports to our Chief Information Officer, who meets with our Board at least annually to discuss cybersecurity risk and related topics.


text: Our CISO's team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. The CISO receives ongoing updates from his team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: In the event of a cybersecurity incident, we have a plan which sets forth a framework to report such incidents to our cybersecurity incident response team. This framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents in a timely manner. As part of this incident response plan, we have retainers in place with professional service firms to assist with cybersecurity incidents if needed.


text: Cybersecurity Risks, Threats and Material Incidents While we are not aware of any cybersecurity incidents that have materially affected us through the date of this report, there can be no guarantee that we will not be the subject of future material cybersecurity incidents. Additional information on cybersecurity risks that we may face can be found in Item 1A – Risk Factors – of this Form 10-K.


text: Cybersecurity Risk Management and Strategy We maintain a data protection and cybersecurity risk management program based upon the National Institute of Standards and Technology (NIST) Cybersecurity framework and the Cybersecurity Maturity Model Certification (CMMC) program to assess, identify and manage cybersecurity risks. As part of this program, we maintain defensive network perimeter safeguards, internal mitigation and control features, continuous system and network monitoring, and contingency data protection. In the event of an incident, we intend to follow our detailed incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with NIST and CMMC standards and industry best practices.


text: Nisha Patel, Director of Quality & Regulatory Affairs, whose expertise in regulatory compliance ensures that our cybersecurity policies meet the required standards.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see Item 1A, "Risk Factors."


text: Cybersecurity Governance Our cybersecurity program is managed by a global internal team that addresses potential risks, implements processes to support our cybersecurity program and responds to potential cyber incidents. The team has decades of experience with varied certifications and includes our Senior Director of IT who has over 20 years of experience as an IT professional engaged in network architecture and cybersecurity. The internal team is supported by third party providers to expand coverage, expertise and responsiveness.


text: Annual risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. Management regularly provides data protection and cybersecurity reports to the Audit Committee and the Board of Directors, which includes updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.


text: Cybersecurity Risk Management and Strategy Our cybersecurity policies and processes are fully integrated into our Risk Management procedures and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. We plan to brief the Board of Directors on our strategy and roadmap in alignment with the NIST Cybersecurity Framework and we plan to provide our Board with regular updates regarding cybersecurity risks, threat landscape and overall program progress.

companyName: EACO CORP

ticker: EACO


text: We believe that the risks from cybersecurity threats thus far, including any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business, including our business strategy, financial condition or results of operations. For additional information about the cybersecurity risks, see Part I, Item 1A. " Risk Factors," of this Annual Report.


text: Education and Awareness We provide required security awareness education and training to our employees and contractors with system access that focuses on various aspects of the cybersecurity world. Users of our internal systems are required to complete an annual cybersecurity awareness training and are tested for awareness on a regular basis. We also provide tailored training courses to functional technology employees and employees who process personal or sensitive information.


text: Threat Management, Incident Response, and Recovery Planning We have established and maintain a comprehensive incident response and recovery plan designed to identify, contain and eradicate cybersecurity threats, with recovery from an incident as rapidly as possible. Our information security team utilizes threat technologies and vendors 24/7 to monitor and respond to security threats. In the event of a security incident, a defined procedure outlines containment, response and immediate recovery actions. The incident response plan is tested, evaluated and updated no less than on an annual basis.


text: Data and Consumer Privacy Our data and consumer privacy program monitors, adapts to and works diligently to comply with changes in global privacy legislation. We have implemented technical, procedural and organizational measures designed to comply with applicable data protection and consumer privacy laws. We conduct external benchmarking, as well as privacy compliance audits, to stay abreast of developing privacy laws and understand developing risks, best practices and industry trends.


text: Third-Party Risk Management We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems. The Company has processes in place to oversee and manage these risks. We have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to our use of key third-party service providers.


text: Cybersecurity Governance Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, our cybersecurity program is led by the Director of Information Technology ("Director of IT"), who reports to the President and COO. Our Director of IT has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint and attends training in cybersecurity and risk mitigation.


text: We plan to provide our Board of Directors with a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the President also will report to the Board of Directors on various metrics on threat management, incident response and recovery planning, along with industry benchmarks.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company in which cybersecurity is a critical component. Our Chief Information Officer and Information Security Officer are primarily responsible for the cybersecurity program. The Chief Information Officer reports directly to the CEO and the Information Security Officer reports directly to the Chief Risk Officer to maintain independence. Our Information Security Officer provides periodic reports to the Board Audit Committee, the Enterprise Risk Management Committee, Operational Risk Committee and Information Security Committee regarding the Cybersecurity/Information Security Program.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: We engage in regular monitoring and assessments of our technology infrastructure utilizing our internal staff and third-party specialist. Our independent auditors periodically review our processes, systems and controls related to our information security program to ensure they are operating effectively.


text: Measures Taken to Mitigate Cybersecurity Risks To mitigate the risk of cyber threats, we have implemented a comprehensive set of technical, organizational, and procedural safeguards that are designed utilizing the Cybersecurity Framework of the National Institute and Standards and Technology (U.S. Department of Commerce), industry standards and regulatory guidance that include the following:


text: Governance and Oversight: A dedicated Information Security Committee oversees our cybersecurity strategy, with executive leadership providing strategic direction. The Information Security Committee reports up to our Operational Risk Committee comprised of Executive Management and subsequently reports up to the Board Audit Committee.


text: Data Protection: We utilize advanced encryption and access controls to protect sensitive data both in transit and at rest. Regular audits are conducted to identify and address any vulnerabilities in our data storage and transmission practices.


text: Employee Training and Awareness: We conduct regular cybersecurity training and awareness programs for employees at all levels to ensure they understand and follow best practices in identifying and reporting potential cyber threats, including phishing attacks and social engineering tactics.


text: Third-Party Risk Management: We assess the cybersecurity practices of third-party vendors and partners, particularly those with access to sensitive information or critical systems and require them to adhere to security standards that align with our own policies.


text: Incident Response: We have a detailed Incident Response Plan that outlines how we would respond to an actual or potential cybersecurity incident. The plan includes the appropriate notification and escalation requirements including timely reporting to our CEO and Board of Directors and engagement of appropriate third parties such as insurance providers and incident response professionals.


text: Resilience and Recovery: We have developed and regularly test our business continuity and disaster recovery plans to ensure a swift recovery in the event of a cybersecurity incident. This includes regular backups, redundant systems, and an established communication protocol.


text: Ongoing Efforts and Improvements We continue to enhance our cybersecurity posture by investing in the latest technologies and partnering with leading cybersecurity experts. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats. Our Information Security Officer has extensive bank operations experience, has attained Certified Information Security Manager certification with the Information Systems Audit and Control Association, and attends relevant cybersecurity training sessions on a regular basis. Our CIO brings over 25 years of extensive experience in the banking industry, encompassing a diverse range of expertise, including software development, managed services and support, independent consulting, penetration testing, and bank management. This multifaceted background equips them with a unique perspective and deep understanding of both the technical and operational aspects of the financial sector. We remain committed to continually improving our cybersecurity infrastructure and to monitoring for new and evolving threats.


text: In the event of a cybersecurity incident, the IT team implements the Company's incident response plan to mitigate immediate impacts, implement remediation strategies, and prevent future incidents. The team also ensures that senior management is regularly informed about material cybersecurity risks and incidents to maintain alignment with organizational priorities.

companyName: Energy Services of America CORP

ticker: ESOA


text: As of the date hereof, the Company has not encountered cybersecurity incidents that the Company believes to have materially affected or are reasonably likely to materially affect the Company taken as a whole, including its business strategy, results of operations or financial condition.


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that generally aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage these material risks, safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's data, and maintain the trust and confidence of our customers, business partners, and employees.


text: Risk Management and Strategy The Board of Directors is actively involved in oversight of the Company's risk management framework. The Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity awareness. This integration ensures cybersecurity considerations are an integral part of decision-making processes across the organization.


text: The Company's risk management team collaborates closely with its internal IT team to evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures to ensure the prompt escalation of cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive timely and appropriate information.


text: Given the complexity and evolving nature of cybersecurity threats, the Company engages external experts, such as cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. These engagements include audits, threat assessments, and consultations on security enhancements. Such collaboration ensures the Company leverages specialized knowledge to maintain cybersecurity practices aligned with industry standards. Utilizes advanced technology solutions, such as proactive detection tools, to safeguard its assets and identify threats within its environment.


text: Conducts cyber education and awareness training sessions to equip employees with the necessary knowledge and foster a strong security culture. Analyzes internal and external cybersecurity incidents and threat intelligence to assess relevance to its environment and industry. Performs recovery testing to ensure the resilience of critical systems and support business continuity.


text: Implements stringent oversight of third-party service providers, including conducting security reviews before engagement and ongoing monitoring to ensure compliance with the Company's cybersecurity standards.


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. As discussed below, members of management advise the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks with financial statement or financial statement reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively.


text: The Board of Directors and the Audit Committee receive briefings from the Company's Chief Information Officer ("CIO"), Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to scheduled briefings, ad hoc discussions regarding emerging or potential cybersecurity risks ensure the Board remains informed and engaged in strategic decision-making related to cybersecurity. The Board conducts an annual review of the Company's cybersecurity posture and risk management strategies to identify areas for improvement and maintain alignment with the Company's overall risk management framework.


text: The Company's CIO has over 20 years of experience in the field of technology and security and is instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies. The internal IT team is responsible for the day-to-day implementation of the Company's cybersecurity risk management programs, testing compliance with standards, remediating known risks, and leading employee training programs. The team monitors the latest developments in cybersecurity, including potential threats and innovative risk management techniques, to help prevent, detect, and mitigate cybersecurity incidents.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Aldel Financial II Inc.

ticker: ALDF


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our IPO.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of our overall enterprise risk management program, which we have continued to invest in developing. Our corporate cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party vendors and service providers, and facilitating coordination across different business units of the Company. Our corporate cybersecurity risk management program is based on and audited against industry standards, including ISO 27001 for Information Security Management Systems (ISMS) and the automotive industry's Trusted Information Security Assessment Exchange standard (TISAX).

companyName: Mobileye Global Inc.

ticker: MBLY


text: Our corporate cybersecurity team is responsible for operating our cybersecurity risk management program. The cybersecurity team determines with management an annual workplan for risk assessments, reviews, audits and tests. The cybersecurity team also conducts vulnerability assessments, security reviews and penetration tests on a regular basis in accordance with such workplan. Following risk assessments that require any remediation, the cybersecurity team then conducts a risk treatment and response process, including mitigation, remediation and risk reduction efforts. Our policies also require that Internet-accessible enterprise systems and applications must undergo a penetration test at least annually, and we engage specialized, independent, third parties to conduct penetration tests and specific in-depth reviews of certain enterprise systems and applications.