text: Our Board of Directors is responsible for overseeing cybersecurity risk, primarily through the Audit Committee. Cybersecurity reviews by the Audit Committee and the Board of Directors are scheduled to occur at least quarterly and annually, respectively, or more frequently, as deemed necessary or advisable. Such presentations to the Audit Committee and Board of Directors, as applicable, are made by our COLO and Global CISO, utilizing performance metrics established by CDRM and reported through the ERM framework, and address topics such as cybersecurity threats, incidents, risks, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, and regulatory developments. At times, the Audit Committee may receive additional cybersecurity risk reviews from other members of management and/or internal cybersecurity experts on certain of our key business segments and products. The Audit Committee regularly reports to our Board of Directors regarding the committee's oversight of such cybersecurity matters. Additionally, the COLO and Global CISO may provide ad hoc updates to the Board of Directors and/or the Audit Committee if necessitated by a security incident or other significant developments.


text: HPE, like all organizations operating in the technology landscape, faces significant and persistent cybersecurity risks, which influence business strategy and operations. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected us, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity program, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or vulnerability, which if realized, could reasonably likely materially affect us. Additional information on the cybersecurity risks we face can be found in the section titled "Risk Factors" in Item 1A of Part I of this Annual Report on Form 10-K.

companyName: Hewlett Packard Enterprise Co

ticker: HPE

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: The Company's Chief Financial Officer, or CFO, Information Technology, or IT, manager, legal function and external information technology and cybersecurity service provider help to identify, assess and manage our cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our and our industry's risk profile using various methods, including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, conducting internal audits, and conducting internal and external threat and vulnerability assessments.

stage1Category: Risk Management Process


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, incident detection and response, a vulnerability management policy, business continuity plans, risk assessments, encryption of data, network security controls, access controls, asset management and disposal, physical security, systems monitoring, employee training, penetration testing, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT manager works with our management team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our management team evaluates material risks from cybersecurity threats against our overall business objectives and regularly reports to the Audit Committee of our board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, managed cybersecurity providers, cybersecurity software providers, penetration testing firms, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosted services, CROs, and CMOs. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A titled "Risks Related to Our Business Operations, Employee Matters and Managing Growth."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of our board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our CFO and IT manager. Our CFO has overseen and been responsible for the Company's information technology and cybersecurity programs since 2018, and before that held equivalent responsibilities at another public company. Our IT manager has approximately seven years of experience with testing, implementing and maintaining our information technology systems and security.

stage1Category: Management Role

stage1Method: majority


text: Our CFO is responsible for hiring appropriate personnel, retaining third-party information technology service providers, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel and approving budgets. Our IT manager and our third-party information technology service provider are together responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to key members of management depending on the circumstances. Our CFO works with the Company's IT manager and our third-party information technology service provider to help us mitigate and remediate cybersecurity incidents of which our CFO is notified. In addition, our incident response plan includes reporting to the Audit Committee of our board of directors for certain cybersecurity incidents.


text: The Audit Committee receives regular reports from our CFO concerning the Company's significant cybersecurity threats and risks, and the processes the Company has implemented to address them. The board of directors also has access to reports, summaries and presentations related to the Company's cybersecurity threats, risk and mitigation.


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size, taking into account our operations and risks.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates a layered portfolio of employee training programs, multiple resources to manage and monitor the evolving threat landscape, effective board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.


text: Management and Board Oversight Our board of directors has delegated oversight of our cybersecurity program to our audit committee. Our audit committee, which consists of solely independent directors, reviews our enterprise risk and cybersecurity risks on a regular basis. It also reviews steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity from our information technology team on a periodic basis. The full board of directors also periodically reviews our cybersecurity risks with management and the actions we are taking to mitigate such risks. The CAO or their designee reports to the audit committee on a periodic basis on the status of our cybersecurity program. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for employees.

stage1Category: Board Governance


text: With oversight from our audit committee and our board of directors, our management team including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Chief Operating Officer and General Counsel ("COO/GC"), is responsible for managing all cybersecurity risks and overseeing our security programs. Our information technology team is comprised of our Chief Accounting Officer ("CAO") and other knowledgeable employees, and is responsible for management of our cybersecurity programs. Our information technology team consists of individuals with experience in assessing and addressing cybersecurity risk and is responsible for executing our cybersecurity programs as well as communicating regularly with senior management. Our CEO, CFO and COO/GC have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors. In addition, our cybersecurity program includes engagement of other Company management and employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The principal objectives of our cybersecurity program ("Cybersecurity Program") are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect confidential information, our intellectual property and other assets, and those of our investors, tenants, vendors, partners and employees that may be at risk due to our cybersecurity threats.


text: We use industry recognized cybersecurity frameworks and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, our board, audit committee, senior management, and information technology team continually evaluate and invest in updating and enhancing our Cybersecurity Program.


text: Governance: As discussed in more detail under the "Governance" heading, the Audit Committee provides oversight of the Company's cybersecurity risk management processes in collaboration with our Information Technology Leadership Team, Chief Legal Officer, Vice President of Risk Management and other internal and external experts.

companyName: WillScot Holdings Corp

ticker: WSC


text: Under our Cybersecurity Program, our information technology team and our senior management, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to manage those risks. Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our cybersecurity provider, notifications from employees, vendors or service providers, and notifications from third-party information technology system providers. When cybersecurity incidents occur, our actions are guided by an incident response plan to (i) detect, contain and eradicate threats, (ii) notify the executive management and the Audit Committee Chairman as appropriate based on the severity level of the cybersecurity incident, (iii) recover compromised data and information systems, (iv) limit impacts of any such incident on our operations and (v) report any such incident as required by law or as otherwise appropriate.


text: We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including outside legal counsel and vendors.


text: We consider our cybersecurity risk and related management processes when assessing risk across the Company. Our risk management systems and processes comprise numerous components, including policies and procedures, risk detection systems, tools and protocols, internal auditing, management review, defined lines of communications, cybersecurity awareness training for employees, phishing simulation tests, penetration testing, engagement of outside advisors and experts to assess, test or otherwise assist with aspects of our security controls, regular operations reviews with the CEO, and board (and audit committee) oversight. We use a number of means to assess and manage cyber risks related to our third-party service providers, such as conducting due diligence in connection with onboarding new vendors and legal review of vendor engagements and new products. We utilize the foregoing systems and processes to manage our risks and associated cybersecurity threats.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, unauthorized transactions, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A, "Risk Factors - Risks Related to Our Business - Cybersecurity."


text: Management and Board Oversight Our board of directors has delegated oversight of our cybersecurity program to our audit committee. Our audit committee, which consists of solely independent directors, reviews our enterprise risk and cybersecurity risks on a regular basis. It also reviews steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity from our information technology team on a periodic basis. The full board of directors also periodically reviews our cybersecurity risks with management and the actions we are taking to mitigate such risks. The Chief Accounting Officer ("CAO") or their designee reports to the audit committee on a periodic basis on the status of our cybersecurity program. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for employees.


text: With oversight from our audit committee and our board of directors, our management team including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Chief Operating Officer and General Counsel ("COO/GC"), is responsible for managing all cybersecurity risks and overseeing our security programs. Our information technology team is comprised of our CAO and other knowledgeable employees, and is responsible for management of our cybersecurity programs. Our information technology team consists of individuals with experience in assessing and addressing cybersecurity risk and is responsible for executing our cybersecurity programs as well as communicating regularly with senior management. Our CEO, CFO and COO/GC have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors. In addition, our cybersecurity program includes engagement of other Company management and employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management.


text: Under our Cybersecurity Program, our information technology team and our senior management, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to manage those risks. Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our cybersecurity provider, notifications from employees, vendors or service providers, and notifications from third-party information technology system providers. When cybersecurity incidents occur, our actions are guided by an incident response plan to (i) detect, contain and eradicate threats, (ii) notify executive management and the Chairman of the audit committee as appropriate based on the severity level of the cybersecurity incident, (iii) recover compromised data and information systems, (iv) limit impacts of any such incident on our operations and (v) report any such incident as required by law or as otherwise appropriate.


text: Cybersecurity Risks We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, unauthorized transactions, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A, "Risk Factors - Risks Related to Our Business - We face risks associated with cybersecurity incidents through cyber-attacks, cyber intrusions or otherwise, as well as failures of systems on which we rely and other significant disruptions of our information technology ("IT") networks and related systems."


text: The Board of Directors is committed to maintaining a strong cybersecurity and data protection framework intended to protect our customers, shareholders, employees, and other stakeholders, as well as the integrity of our operations. Our Board is involved in the oversight of the Company's cybersecurity risk management efforts. Our cybersecurity risk management consists of a set of processes designed to assess, identify and effectively manage material risks arising from cybersecurity and data protection threats. These processes are aligned with the Framework for Improving Critical Infrastructure Cybersecurity established by the National Institute of Standards and Technology. Our processes have been integrated into our overall risk management system, consistent with our commitment to safeguarding our operations and data on a Company-wide basis. Our cybersecurity risk management efforts are overseen by our Audit Committee in collaboration with individual members of our management team, specifically our Chief Information Officer, Chief Legal Officer, and Vice President of Risk Management. Generally, our cybersecurity risk management efforts seek to address cybersecurity risks and incident response through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we collect by identifying, preventing and mitigating cybersecurity threats and effectively responding to incidents when they occur. Our efforts also emphasize continuity of systems to ensure minimal disruption and maintain operational integrity during cybersecurity threats and incidents. We regularly review and update our contingency plans, aiming to enhance the resilience of our operations and the consistent functionality of our systems in the face of potential disruptions.


text: Risk Management and Strategy As part of the Company's overall approach to cybersecurity, the Company's cybersecurity risk management processes are focused on the following key areas.


text: Governance: As discussed in more detail under the "Governance" heading, the Audit Committee provides oversight of the Company's cybersecurity risk management processes in collaboration with our Chief Information Officer, Chief Legal Officer, Vice President of Risk Management, information technology team and other internal and external experts.


text: Collaborative Approach: Our cybersecurity risk management efforts include the implementation of a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents. We have various tools in place that allow us to monitor and address threats and incidents that have the potential to materially affect our business strategy, financial condition, and results of operations, which allows us to determine the materiality of and ensure timely public disclosure of any such threat or incident, as appropriate.


text: Technical Safeguards: The Company deploys technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, all of which are evaluated and improved through vulnerability assessments on a periodic basis.


text: Incident Response and Recovery Plans: The Company has established and maintains comprehensive incident response and recovery plans, which detail the steps to be taken from the initial internal reporting of a potential cybersecurity incident.


text: Third Party Involvement and Risk Assessment: We actively and routinely engage assessors, consultants, auditors and other relevant third parties with appropriate expertise in their respective fields for the purposes of effectively maintaining and improving the quality and effectiveness of our processes. We believe this allows us to employ best practices and reduce the risks associated with evolving cybersecurity and data protection threats. We have also implemented industry-recommended practices to oversee and identify threats associated with the use of our third-party service providers.


text: Education and Awareness: The Company provides regular, mandatory trainings for applicable personnel with the purpose of providing personnel with effective tools to address cybersecurity threats and incidents, and to effectively communicate our cybersecurity risk management processes, including all related information, security policies, standards, process and practices.


text: Certain cybersecurity threats have the potential to materially affect our business strategy, financial condition, and results of operations. These threats include the risk of cyberattacks that could result in the disruption of our business operations, loss of sensitive information or data and damage to our reputation with our customers, shareholders, and other stakeholders. We conduct periodic assessments of these threats, and we have developed action plans that are already implemented, or are currently underway to be implemented, based on the results of our periodic assessments.


text: In accordance with our internal policies, our Chief Information Officer, Chief Legal Officer and Vice President of Risk Management, are tasked with certain oversight and management responsibilities related to the monitoring, prevention, mitigation and remediation of cybersecurity threats and incidents. These management members report to the Audit Committee, and the Audit Committee reports to the full Board of Directors, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of efforts to strengthen our information security systems, assessments of our cybersecurity risk management processes, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the emerging threat landscape, technological trends and information security considerations arising with respect to the Company's peers and third parties. These individuals enable the Company to implement measures that help reduce and address the cybersecurity and data protection threats the Company faces. Such measures include, but are not limited to, disaster recovery and business continuity, solution monitoring, network resiliency and simplification, sensitive data security, employee training and testing, system functionality and stability, infrastructure upgrades and more.


text: The Audit Committee (i) periodically reviews the Company's policies related to cybersecurity and data protection, which include the assessment, identification and management of material risks, mitigation strategy, governance and incident reporting, (ii) routinely coordinates with management and the Board of Directors, as applicable, in exercising its oversight over cybersecurity matters, (iii) receives timely information related to cybersecurity threats and incidents that meet specified materiality thresholds, as well as ongoing updates regarding any such threats or incidents until they have been addressed.


text: Management consistently assesses, monitors and manages our cybersecurity practices to align with the evolving threat landscape. Our cybersecurity risk management efforts are designed to protect the Company's information systems from cybersecurity threats and to appropriately respond to any threats or incidents. Through ongoing communications, management and other applicable personnel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee and the Board, as appropriate.


text: The Company's Chief Information Officer has served in various roles in information technology and information security for over 29 years and holds degrees in Business Information Systems and Accounting. The Vice President of Risk Management has served in various roles in information technology and information security for over 18 years, holds an undergraduate degree in Accounting and a Master of Business Administration degree, and is a Certified Public Accountant.


text: The Company tests and evaluates its cybersecurity risk management processes on a regular basis. As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, financial condition or results of operations.


text: The Board of Directors is committed to maintaining a strong cybersecurity and data protection framework intended to protect our customers, shareholders, employees, and other stakeholders, as well as the integrity of our operations. Our Board is involved in the oversight of the Company's cybersecurity risk management efforts. Our cybersecurity risk management consists of a set of processes designed to assess, identify and effectively manage material risks arising from cybersecurity and data protection threats. These processes are aligned with the Framework for Improving Critical Infrastructure Cybersecurity established by the National Institute of Standards and Technology. Our processes have been integrated into our overall risk management system, consistent with our commitment to safeguarding our operations and data on a Company-wide basis. Our cybersecurity risk management efforts are overseen by our Audit Committee in collaboration with individual members of our management team, specifically our Information Technology Leadership Team, Chief Legal Officer, and Vice President of Risk Management. Generally, our cybersecurity risk management efforts seek to address cybersecurity risks and incident response through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we collect by identifying, preventing and mitigating cybersecurity threats and effectively responding to incidents when they occur. Our efforts also emphasize continuity of systems to ensure minimal disruption and maintain operational integrity during cybersecurity threats and incidents. We regularly review and update our contingency plans, aiming to enhance the resilience of our operations and the consistent functionality of our systems in the face of potential disruptions.


text: In accordance with our internal policies, our Information Technology Leadership Team, Chief Legal Officer, and Vice President of Risk Management are tasked with certain oversight and management responsibilities related to the monitoring, prevention, mitigation and remediation of cybersecurity threats and incidents. These management members report to the Audit Committee, and the Audit Committee reports to the full Board of Directors, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of efforts to strengthen our information security systems, assessments of our cybersecurity risk management processes, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the emerging threat landscape, technological trends and information security considerations arising with respect to the Company's peers and third parties. These individuals enable the Company to implement measures that help reduce and address the cybersecurity and data protection threats the Company faces. Such measures include, but are not limited to, disaster recovery and business continuity, solution monitoring, network resiliency and simplification, sensitive data security, employee training and testing, system functionality and stability, infrastructure upgrades and more.


text: Management consistently assesses, monitors and manages our cybersecurity practices to align with the evolving threat landscape. Our cybersecurity risk management efforts are designed to protect the Company's information systems from cybersecurity threats and to appropriately respond to any threats or incidents. Through ongoing communications, management and other applicable personnel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee and the Board of Directors, as appropriate.


text: Members of the Information Technology Leadership Team have experience managing risks arising from cybersecurity threats and hold security certifications including Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM). The Company's Vice President of Infrastructure and Information Technology Operations has served in various information technology security, infrastructure, and application roles for over 27 years and is supported by a team of information technology and cyber security professionals with decades of relevant experience. The Vice President of Risk Management has served in various roles in information technology and information security for over 18 years, holds an undergraduate degree in Accounting and a Master of Business Administration degree, and is a Certified Public Accountant.


text: Risk Management and Strategy We have established policies and processes for identifying, assessing, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: We conduct risk assessments to identify cybersecurity threats annually as well as in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Risk Officer, to manage the risk assessment and mitigation process. Our Chief Information Security Officer works closely with a team of cybersecurity professionals with extensive experience and expertise in cybersecurity threat assessments and detection, incident response and mitigation.


text: As part of our overall risk management system, we assess our safeguards in collaboration with various functional teams, including Information Security, Information Technology, Risk and Legal, and train our employees on these safeguards. Personnel at all levels and teams are required to receive periodic security awareness training to ensure that they understand our cybersecurity policies and their roles in protecting our information systems or any information residing therein.


text: We have a set of company-wide policies and procedures concerning cybersecurity matters that include security risk assessment, identity and access control, vendor security and network security. There are other policies related to cybersecurity involving employees' use of company equipment and resources, generative AI, remote work and workplace security and safety. These policies are reviewed periodically and approved by appropriate members of management.


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. These services include Web Application Penetration Testing, Infrastructure security testing, NIST assessments, third party partner due diligence audits, consultant engagements, incident response preparedness, and vendor security review. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, in connection with the services they provide to us, and to promptly report any suspected breach of its security measures that may affect us.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please see Item 1.A. "Risk Factors" of this Annual Report on Form 10-K, including the risk factors titled "—Security breaches and incidents compromising borrowers' confidential information that we store may harm our reputation, adversely affect our results of operations and expose us to liability".

stage1Category: None/Other


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for oversight of our risk management framework, which is designed to monitor and manage strategic and operational risks. Management is responsible for the day-to-day identification, assessment and management of risks in our operations, including cybersecurity risks. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Information Security Officer has more than 20 years of information security expertise and is primarily responsible to identify, assess and manage our material risks from cybersecurity threats. Our Chief Information Security Officer started his career as a security engineer and has held various leadership positions in the security function at Microsoft, Netflix, Bridgewater Associates and, most recently, Robinhood. He received a bachelor degree in management information systems and holds an industry certification.


text: The Company continues to invest in its cybersecurity program and performs assessments to identify opportunities to enhance training and awareness and improve processes and technology used to identify, prevent, detect, respond, and recover from cybersecurity incidents.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Our Chief Information Security Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: tabletop exercises, vulnerability management programs, internal & external security risk assessments, threat modeling processes of new services, third party security risk functions, incident response processes, phishing awareness programs, and additional control validation services.


text: Our Chief Risk Officer reports to our CEO, and our Chief Risk Officer and/or Chief Information Security Officer provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing and activities of third parties. Our audit committee provides updates to the Board of Directors on such reports. We also have an established incident response plan led by our Chief Information Security Officer that lays out the process for the assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, our process, including those set forth in the incident response plan, provides for escalation and notification to management, the audit committee and the Board of Directors and/or external parties, as appropriate.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Risk Officer, to manage the risk assessment and mitigation process. Our Chief Information Security Officer works closely with a team of cybersecurity professionals with extensive experience and expertise in cybersecurity control development, threat assessments, detection & incident response and mitigation.


text: As part of our overall risk management system, we assess our safeguards in collaboration with various functional teams, including Information Security, Engineering, Risk and Legal, and train our employees on these safeguards. Security is a shared responsibility, and personnel at all levels and teams are required to receive periodic security awareness training to ensure that they understand our cybersecurity policies and their roles in protecting our information systems or any information residing therein.


text: We have a set of company-wide policies and procedures concerning cybersecurity matters that include security risk assessment, identity and access control, vendor security and vulnerability management. There are other policies related to cybersecurity involving employees' use of company equipment and resources, generative AI, remote work and workplace security and safety. These policies are reviewed periodically and approved by appropriate members of management.


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. These services include product penetration testing, third party partner due diligence audits, security controls assessment, incident response preparedness, and vendor security review. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, in connection with the services they provide to us, and to promptly report any suspected breach of its security measures that may affect us.


text: Given the risks associated with third-party service providers, thorough assessments are conducted before engagement and ongoing monitoring is maintained to ensure compliance with organizational standards. Elements of the assessment include cyber, financial, reputational, compliance, legal, strategic and operational reviews. The Third-Party Risk Management department, reporting directly to our CISO, oversees this critical process.

companyName: FB Financial Corp

ticker: FBK

stage1Category: Third-Party Risk


text: Our Chief Information Security Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy " above. The processes by which our Chief Information Security Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: tabletop exercises, vulnerability management programs, internal & external security risk assessments, threat modeling processes of new services, third party security risk functions, incident response processes, phishing awareness programs, and additional control validation services.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials ("Information Systems and Data").

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Our information security function, overseen by our Senior Vice President of IT and Facilities ("SVP of IT and Facilities") and supported by members of our IT, Legal and Finance departments, and our third-party IT service providers, helps identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example: using manual and automated monitoring tools; subscribing to reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting internal and external audits for certain data and systems; conducting threat assessments for internal and external threats; conducting vulnerability assessments to identify vulnerabilities; penetration testing; and having third parties conduct threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response process; conducting risk assessments; encrypting certain of our data; segregating certain of our data; implementing network security controls; maintaining access and physical security controls; asset management processes for managing, tracking, and disposing of assets; monitoring our corporate systems; and providing security awareness training to employees.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our cybersecurity risks.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity consultants, cybersecurity software and hardware providers, outside legal counsel, penetration testing firms, dark web monitoring services, and forensic investigators.


text: To further strengthen the Bank's preparedness, cybersecurity insurance coverage is maintained with coverage levels periodically reviewed to ensure alignment with the risk appetite.


text: Risk Management for Third-Party Providers: We conduct due diligence when selecting and periodically reviewing third-party service providers, suppliers, and vendors to ensure they comply with necessary cybersecurity standards.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We use certain vendor management processes to help manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including, for example, requiring our vendors to complete security questionnaires and conducting vulnerability scans related to our vendors' services.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems or those of the third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, significant fines or other liability; regulatory investigations or actions; disruptions of our development programs or business operations; harms to our reputation, and other adverse consequences."


text: Cybersecurity Governance Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in our management, including our S VP of IT and Facilities, who has over 30 years of IT experience, including 10 years of information security experience, in various IT leadership roles in life sciences companies.


text: Our SVP of IT and Facilities is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our SVP of IT and Facilities is responsible for preparing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including our President and CFO. Our President and CFO works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives quarterly or as needed reports from our SVP of IT and Facilities concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. We use people, process, and technology controls to manage and mitigate cybersecurity risk. The Company's Board of Directors delegates oversight of the Bank's processes for identifying, assessing, and mitigating material risks, including cybersecurity risks, to the Board Audit and Risk Management Committee. Senior Leadership, including the CTO and CRO, managed third-party service providers and advisors to maintain and continuously enhance the Bank's Information Security Program. The CTO, CRO, and the Bank's third-party virtual ISO regularly present to the Board Audit and Risk Management Committee on the state of cybersecurity at the Bank, including any business-impacting incidents and emerging industry risks. The virtual ISO has over 30 years of experience in IT, Information Security, Business Continuity, and Technology Risk in the Financial Services sector and maintains several industry-recognized security, audit, privacy and governance certifications.

companyName: BayFirst Financial Corp.

ticker: BAFN


text: While robust cybersecurity measures have been implemented, the Bank has not experienced any material impacts from cybersecurity threats to date. This is not a guarantee that potential future events will be immaterial. The evolving nature of cyber threats means that new risks will emerge. These threats could potentially affect the Bank's business strategy, operations, or financial condition. For potential impacts of future threats, refer to "Item 1A - Risk Factors - Technology and Operational Risks."


text: We recognize the importance of managing cyber risks that we face and have established processes as part of our enterprise risk management, or ERM, program to identify, assess, and manage risks associated with cybersecurity. Our Board retains oversight of our cybersecurity risk management. Our cybersecurity program is informed by industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the information that we collect and store.

companyName: Toast, Inc.

ticker: TOST


text: Key elements of the comprehensive Information Security Program include: • A mix of administrative and technical tools and controls appropriate to the size and complexity of the Bank to protect the confidentiality, integrity, and availability of critical systems and data, including the privacy of customer data, in compliance with applicable laws and regulations. • Risk assessments are conducted to: (a) identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of critical Bank systems and data, (b) determine the likelihood and potential impact of the threats, and (c) determine the sufficiency of controls and mitigating factors to reduce the risks identified. • A detailed Cyber Incident Response Plan which includes engagement of a third-party that specializes in cybersecurity for financial institutions to assist in incident response and recovery and communications with the Board, regulators, law enforcement and Federal and State Government offices, as required. While the Bank has not experienced a business-impacting cyber incident to date, the Cyber Incident Response Plan is tested at least annually and updated as required so that personnel are prepared for an actual incident. • Security Awareness training to help employees understand their information protection and cybersecurity responsibilities, including targeted campaigns on common social engineering techniques utilized by threat actors. • A third-party risk management program to classify suppliers according to risk and identify those that require enhanced cyber due diligence. • Annual independent third-party penetration tests, vulnerability scans, assessments and audits of the Bank's Information Security Program elements.


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks have materially affected the Company, including its business strategy, results of operations or financial condition. As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. The Company uses a blend of people, process, and technology controls to manage and mitigate cybersecurity risk. The Company's Board of Directors delegates oversight of the Bank's processes for identifying, assessing, and mitigating material risks, including cybersecurity risks, to the Board Audit and Risk Management Committee. Senior Leadership, including the CTO and CRO, manage third-party service providers and advisors to maintain and continuously enhance the Bank's Information Security Program. The CTO, CRO, and the Bank's third-party virtual ISO regularly present to the Board Audit and Risk Management Committee on the state of cybersecurity at the Bank, including any business-impacting incidents and emerging industry risks. The virtual ISO has over 30 years of experience in IT, Information Security, Business Continuity, and Technology Risk in the Financial Services sector and maintains several industry-recognized security, audit, privacy and governance certifications.


text: Key elements of the comprehensive Information Security Program include: • A mix of administrative and technical tools and controls appropriate to the size and complexity of the Bank to protect the confidentiality, integrity, and availability of critical systems and data, including the privacy of customer data, in compliance with applicable laws, rules, and regulations. Control coverage includes Board approved policies, layers of network security, encryption of data at rest and in transit, vulnerability scans of technology assets, logging and monitoring, identity and access management, secure coding, and email security. • Risk assessments are conducted to: (a) identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of critical Bank systems and data, (b) determine the likelihood and potential impact of the threats, and (c) determine the sufficiency of controls and mitigating factors to reduce the risks identified. • A detailed Cyber Incident Response Plan which includes engagement of a third-party that specializes in cybersecurity for financial institutions to assist in incident response and recovery and communications with the Board, regulators, law enforcement and Federal and State Government offices, as required. While the Bank has not experienced a business-impacting cyber incident to date, the Cyber Incident Response Plan is tested at least annually and updated as required so that personnel are prepared for an actual incident. In addition, targeted cybersecurity playbooks are maintained to respond to common threats, including malware, ransomware and denial of service attacks. • Security Awareness training to help employees understand their information protection and cybersecurity responsibilities, including targeted campaigns on phishing and other common social engineering techniques utilized by threat actors. • A third-party risk management program to classify suppliers according to risk and identify those that require enhanced cyber due diligence. • Annual independent third-party penetration tests, external vulnerability scans, assessments and audits of the Bank's Information Security Program elements.


text: Cybersecurity governance The Bank has implemented a comprehensive set of information security policies, standards, and related training programs to promote awareness and prevention of cybersecurity risks. All employees are required to: • Review and acknowledge the information security framework upon hiring. • Formally review and understand updates to these policies. • Complete annual training sessions addressing data privacy and security, password protection, internet use, social engineering risks, and other key cybersecurity topics. These efforts ensure employees remain vigilant and informed about evolving threats and best practices.


text: Strategy and program oversight We recognize the critical importance of developing, implementing, assessing and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. The Risk Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. Our Chief Information Security Officer is primarily responsible for the implementation of risk mitigation strategies. Our CISO has over 35 years of information technology and cybersecurity experience. He has held the title of CISO and has been in this role since 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications. Our CISO regularly briefs the Risk Committee of the Board of Directors on our cybersecurity and information security posture. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts in addition to our experienced information security team. These external experts include cybersecurity assessors, consultants and auditors in evaluating and testing our cybersecurity risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry and best practices. Our collaboration with these entities includes regular audits, threat assessments and consultation on security enhancements.


text: Integrated risk management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Key Risk Indicators, established in conjunction with Board approved Statement of Risk Appetite, are reported to the Information Technology Steering Committee, Risk Management Committee and the Risk Committee of the Board of Directors on at least a quarterly basis. The Board's Risk Committee is provided an information security update on an annual basis. This escalation process provides for communication of any needed mitigation and remediation efforts related to cybersecurity risks.


text: We have implemented a comprehensive set of information security policies, standards, and related trainings to promote awareness for prevention and detection of cybersecurity risk. Every employee is required to review, acknowledge, and/or complete the information security framework in connection with the employee's onboarding process at the time they are hired. Additionally, each employee is required to formally review and understand any changes to these policies and standards and complete additional training on at least an annual basis. These policies, standards, and trainings address, but are not limited to, the following topics: data privacy and security, password protection, internet use, computer equipment and software use, e-mail use, risks associated with social engineering, and best-practices and safety. Our internal audit team and bank examiners audit and review our information security program and risk mitigations on an annual basis. Additionally, external auditors audit specific components of the information security program as part of the annual financial statements audit. We adhere to and implement NIST guidelines and utilize the American Banker's Association recommended Cyber Risk Institute Profile to annually evaluate our information security practices.


text: Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct thorough security assessments of third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The Third-Party Risk Management department reports to our CISO.


text: The Company also maintains coverage under a cyber security insurance policy. Levels of coverage are reviewed periodically to ensure alignment with the organization's risk appetite.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see "Item 1A - Risk Factors - Technology and Operational Risks."


text: Cyber risk management and strategy The Bank recognizes the critical importance of developing, implementing, assessing, and maintaining appropriate cybersecurity measures to safeguard information systems and protect the confidentiality, integrity, and availability of data. The Risk Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. The Chief Information Security Officer with experience in information technology and cybersecurity, is primarily responsible for implementing cyber risk mitigation strategies and is supported by a team of skilled professionals holding cybersecurity-related certifications.


text: To ensure the robustness of cybersecurity strategies, the Bank actively collaborates with external experts, including cybersecurity assessors, consultants, and auditors, who provide specialized knowledge and insights. These partnerships include regular audits, threat assessments, and consultations on security enhancements. The Bank's CISO regularly briefs the Risk Committee of the Board of Directors on cybersecurity and information security posture.


text: Cybersecurity risk management is integrated into the Bank's broader risk management framework to foster a company-wide culture of cybersecurity awareness. Key risk indicators, aligned with the Board-approved Statement of Risk Appetite, are reported quarterly to multiple management level committees and the Risk Committee of the Board of Directors. This process ensures timely communication and escalation of issues along with the required mitigation and remediation efforts related to cybersecurity risks.


text: The Bank's information security program undergoes rigorous internal and external auditing. The internal audit team and bank examiners conduct annual reviews to evaluate program's effectiveness and risk mitigation efforts. Additionally, external auditors assess specific components of the information security program as part of the annual financial statements audit. The program is designed in accordance with the National Institute of Standards and Technology guidelines and the Cyber Risk Institute Profile recommended by the American Bankers Association underscoring our commitment to maintaining a strong cybersecurity governance framework.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and vendors based on their criticality and risk profile.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We may be vulnerable to security breaches or cyber-attacks which could disrupt our operations and have a material adverse effect on our financial performance and operating results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Accounting Officer.


text: Our management team, including our Chief Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over ten years of overseeing IT risk management and compliance, day-to-day IT operations, and coordinating with external IT security experts. Our Chief Accounting Officer also works in tandem with an external cybersecurity consultant that has experience in cybersecurity assessment, response, and mitigation.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Containment —perform short-term containment, for example by isolating the network segment that is under attack; then focus on long-term containment, which involves temporary fixes to allow systems to be used in production, while rebuilding clean systems.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: Governance Related to Cybersecurity Risks Our Board holds oversight responsibility over our strategy and risk management, including risks related to cybersecurity threats. Under the oversight of the Audit Committee, we have implemented an ERM framework that includes processes for identifying, assessing, and responding to cyber risk exposures. The enterprise risk management process is led by our chief compliance officer, where team members are responsible for working with cross-functional counterparts at the Company to assess risks across designated verticals, including cybersecurity. The chief compliance officer reports on the ERM process to the Audit Committee of our Board regularly. In addition, we have established a working council, or our Enterprise Risk and Compliance Committee, that meets regularly to review and report on the ERM framework to senior leadership.


text: Our Chief Information Security Officer, or CISO, who has decades of experience in similar roles in the technology industry, leads and oversees our information security program, including our cybersecurity policies and information security team. This team is responsible for implementing processes designed to identify and protect company assets through prevention and detection controls. Through our cybersecurity program, we have developed response and recovery processes and procedures designed to address potential adverse impacts to the company should a cyber event or incident occur. We have implemented a process for employees to complete security and awareness training annually.


text: Management reports cybersecurity risks to the Enterprise Risk and Compliance Committee in accordance with the risk management program and to our Board's Audit Committee in an effort to keep members of the Audit Committee apprised of the rapidly evolving cyber threat landscape and to enable the assessment of the effectiveness of our overall cybersecurity and compliance programs.


text: Cyber Risk Management and Strategy Processes to identify, assess, and manage risks presented by cybersecurity threats are integrated into our overall ERM program and are informed by industry cybersecurity standards. Our CISO, with support from the information security team, leads a risk assessment process to regularly evaluate cybersecurity risks. This process is also supported by periodic security testing and monitoring.


text: Our CISO reviews and contributes to the cybersecurity risk reporting that is provided to the Audit Committee of our Board on a quarterly basis. The quarterly updates include cybersecurity risk assessment results, which include risks associated with the use of third-party service providers, and cover efforts to mitigate previously identified risks. Our CISO also oversees the incident response team and is responsible for updating our Board on any cybersecurity incidents, including the mitigation and remediation of these incidents, should they occur.


text: As discussed within "Item 1A, Risk Factors", we rely on service providers to process sensitive business information. As part of our risk management program, we have implemented a process to conduct a security review of third-party service providers, including through vendor questionnaires and contractual-related security requirements, as appropriate. In addition, we engage third-party experts, including external legal counsel and cybersecurity advisors, to assist in our identification and management of cybersecurity risks as needed. We have established an incident response process to assess, respond, and report in the event that a cybersecurity incident is detected. Management has assembled a committee to assess the materiality of the impact of identified cybersecurity incidents on our business and determine any disclosure obligations arising from such incidents.


text: Cybersecurity is incorporated into our business strategy as cybersecurity risks may have a negative impact on our business as outlined within "Item 1A, Risk Factors." Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and security incidents of our and our third-party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."


text: We recognize the importance of managing cyber risks that we face and have established processes as part of our overall enterprise risk management, or ERM, program to identify, assess, and manage risks associated with cybersecurity. Our Board retains oversight of our cybersecurity risk management. Our cybersecurity program is informed by industry standards, including the National Institute of Standards and Technology, or NIST, Cybersecurity Framework. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the information that we collect and store.


text: Governance Related to Cybersecurity Risks Our Board holds oversight responsibility over our strategy and risk management, including risks related to cybersecurity threats. Under the oversight of the Audit Committee, we have implemented an ERM framework that includes processes for identifying, assessing, and responding to cyber risk exposures. The enterprise risk management process is led by our chief compliance officer, where team members are responsible for working with cross-functional leadership at our Company to assess risks across designated verticals, including cybersecurity. The chief compliance officer reports on the ERM process to the Audit Committee of our Board regularly. In addition, we have established a management committee, or our Enterprise Risk and Compliance Committee, that meets regularly to review and report on the ERM framework to senior leadership.


text: Eradication —remove malware from all affected systems, identify the root cause of the attack, and take action to prevent similar attacks in the future.


text: Our Chief Information Security Officer, or CISO, who has decades of experience in similar roles in the technology industry, leads and oversees our information security program, including our cybersecurity policies and information security team. This team is responsible for implementing processes designed to identify and protect company assets through prevention and detection controls. Through our cybersecurity program, we have developed prevention, response and recovery processes and procedures designed to address potential adverse impacts to our company should a cyber event or incident occur. We have implemented security and awareness training which is required for all employees during onboarding and annually thereafter, and we conduct regular phishing simulations.


text: Management reports cybersecurity risks to the Enterprise Risk and Compliance Committee in accordance with the risk management program and to our Board's Audit Committee in an effort to keep our Board apprised of the rapidly evolving cyber threat landscape and to enable the assessment of the effectiveness of our overall cybersecurity and compliance programs.


text: Cyber Risk Management and Strategy Processes to identify, assess, and manage risks presented by cybersecurity threats are integrated into our overall ERM program and are informed by industry cybersecurity standards, including the NIST Cybersecurity Framework. Our CISO, in collaboration with the team responsible for the ERM program and the information security team, conducts a risk assessment process to regularly evaluate, monitor, manage, and mitigate cybersecurity risks. This process is also supported by periodic security testing and monitoring.


text: Our CISO reviews and contributes to the cybersecurity risk reporting that is provided to the Audit Committee of our Board on a quarterly basis. The quarterly updates include cybersecurity risk assessment results, which include risks associated with the use of third-party service providers, and cover efforts to mitigate previously identified risks. Our CISO also oversees the cybersecurity incident response team and is responsible for updating our Board on any cybersecurity incidents, including the mitigation and remediation of these incidents, should they occur.


text: As discussed within "Item 1A, Risk Factors", we rely on service providers to process sensitive business information. As part of our risk management program, we have implemented a process to conduct a security review of third-party service providers, including through vendor questionnaires and contractual-related security requirements, as appropriate. In addition, we engage third-party experts, including external legal counsel and cybersecurity advisors, to assist in our identification and management of cybersecurity risks as needed. We have established an incident response process to assess, respond, and report in the event that a cybersecurity incident is detected. Management has also assembled a committee and an escalation protocol in connection with evaluating cybersecurity incidents for any potential disclosure obligations arising from such incidents.


text: Cybersecurity is incorporated into our overall business strategy as cybersecurity risks may have a negative impact on our business as outlined within "Item 1A, Risk Factors." Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and security incidents of our and our third-party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Atlassian Corp

ticker: TEAM


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Secure Software Development Framework ("SSDF"). This does not imply that we meet any particular technical standards, specifications, or requirements; we use NIST CSF and SSDF as guides to help us identify, assess, and manage risks from cybersecurity threats relevant to our business.


text: Cybersecurity risks are incorporated into our overall enterprise risk management program. Our Chief Trust Officer ("CTrO") reports to our Chief Technology Officer and oversees our trust and overarching security strategy.


text: Our Chief Information Security Officer ("CISO") reports to our CTrO and oversees the technical identification, assessment and management of cybersecurity risks relevant to our business.


text: Our Head of Information Security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Head of Information Security has approximately 20 years of cybersecurity expertise, including more than 15 years working in information security with the U.S. Federal Reserve System, serving most recently as the Assistant Vice President for Operations and Information Security. He has received both a GIAC Security Leadership certificate and a Certified Information Systems Security Professional certification.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: Third-Party Risk Management: Recognizing the significance of external threats, we have implemented a risk-based strategy to manage cybersecurity risks associated with third parties, such as vendors and service providers. This strategy extends to these third parties' systems, which, if compromised, could impact our operations.

companyName: WIDEPOINT CORP

ticker: WYY


text: Our cybersecurity risk management program includes, among other elements: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. • A Security team, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test, respond to or otherwise assist with aspects of our security controls, as well as maturity assessments of our cybersecurity program. • Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training for employees in specific incident response roles, as well as for employees with specific access to systems, devices, or locations, and targeted cybersecurity incident simulation training held on a recurring basis. • Incident response playbooks and standard operating procedures outlining procedures for detecting, responding to, and mitigating cybersecurity incidents. Depending on the nature and severity of an incident, responses may involve escalating notification to our Chief Executive Officer and our board of directors. • Post-incident reviews are conducted for major incidents, and to determine steps that may be taken to mitigate identified risks and reduce the likelihood of reoccurrence. • Internal policies designed to protect our systems and operations, including (1) a data classification and labelling standard to evaluate the confidentiality level of internal information, (2) a cloud continuity policy to address experience disruption for cloud customers, and (3) a business resilience policy to provide a framework for operations during and after disruption events. • A third-party risk management process for service providers, suppliers, and vendors. Such service providers are subject to risk tiering, security risk assessments, and recurring reviews, as applicable. When third-party provider incidents occur, we assess their materiality to our operations and investigate accordingly.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, whether individually or in the aggregate, have materially affected or are reasonably likely to materially affect us, our business, and our results of operations in Part I, Item 1A in this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to its audit committee (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, and it reports to the full board of directors regarding its activities, including those related to cybersecurity. Our CTrO and CISO provide updates on significant risks to the Audit Committee quarterly and also provide updates to the full board of directors at least biannually. Outside of regular meetings, depending on the nature and severity of an incident, our CTrO and CISO will also inform the Audit Committee, Chief Executive Officer, and the rest of the board of directors of significant cybersecurity incidents.


text: Our CTrO leads our Trust and Security organization, focusing on maintaining customer trust and overseeing the overall security posture of the company. The CTrO's role involves managing cybersecurity risks and reviewing whether the company's security practices align with customer expectations and industry standards. Our CISO leads our Security organization and is responsible for all security-related activities and controls at Atlassian. This includes defining the security strategy, developing, and enforcing security standards, and managing security technologies. The CISO also oversees security operations, incident response, and reviews compliance with legal and regulatory requirements. Our CTrO has served in his role since October 2023 and has extensive experience in the cybersecurity space, including previously serving as Chief Trust Officer of a large publicly-traded enterprise software company. Our CISO has served in his role since December 2024 and also has extensive experience in cybersecurity, including serving as Chief Information Security Officer of a large publicly-traded enterprise software company. Our CTrO and CISO oversee our efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Within the Trust and Security organizations, we implement a structured approach to proactively manage cybersecurity risks. Our Security Governance, Risk and Compliance team monitors, assesses, and coordinates proactive identification and remediation efforts for cybersecurity risks impacting Atlassian. This team partners cross-functionally with others in the Security organization and individuals from our legal, internal audit, engineering, and product development teams. Our Security team includes individuals with experience across a broad range of cybersecurity areas, including, but not limited to: product security; cloud security; infrastructure security; security monitoring and incident response; identity and access management; vulnerability management; and governance, risk, and compliance.


text: We have established certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology functions and are designed to help protect our information, assets and operations from internal and external cyber threats. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, as appropriate to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.


text: We do not believe that there are currently any known risks from cybersecurity threats that have or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors oversees our cybersecurity and data privacy risk management activities, and reports to the Board regarding such oversight as appropriate. The Audit Committee receives updates from management regarding cybersecurity matters not less than twice per year, and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: We have also established a cross-functional Cybersecurity Incident Response Team led by our Head of Information Security serving as the chair and consisting of senior-level functional leaders, with appropriate members of our executive leadership team added on an ad hoc basis as necessary for any particular threat or incident. This team seeks to safeguard the confidentiality, integrity, and availability of our critical information assets and protect against cyber threats through establishing a proactive and effective incident response program, fostering a culture of security awareness, and ensuring the continuous improvement of our incident response capabilities. In the event of a cyber security incident, the team is responsible for the swift detection, containment, mitigation, and recovery from such incident to minimize business disruption, protect intellectual property, and maintain the trust of our stakeholders.


text: In an effort to deter prevent and detect cyber threats, we provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks we face, please refer to Part I, Item 1A "Risk Factors—Risks Related to Employee Matters, Managing Growth, Public Health and Information Technology—Security breaches and other disruptions to our information technology structure could compromise our information, disrupt our business and expose us to liability, which would cause our business and reputation to suffer" of this Annual Report on Form 10-K.


text: In an effort to deter prevent and detect cyber threats, we provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training and compliance program functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. Our security efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Overview of Cybersecurity Risk Management and Strategy Our cybersecurity risk identification, assessment and management process is a critical part of our overall enterprise risk management ("ERM") system. Within our ERM system, we adhere to our Information Security Management Policy ("ISM Policy") which is aimed at providing guidelines to monitor, review and continually improve our Information Security Management System ("ISMS"). Our ISMS is informed by ISO/IEC 27001:2013 standards and is operated based on an action model that identifies information security missions and objectives, including improvement measures to achieve continuous optimization. Our Cybersecurity Incident Response Plan ("CIRP") is a critical component of our cybersecurity risk identification and management process, which, along with our incident response team, is designed to guide our response to potential cybersecurity incidents effectively and efficiently. Our ISM Policy, ISMS and CIRP are all internal tools we use to assess, identify and manage material risks from cybersecurity threats.


text: We also utilize external partnerships to help protect the Company from cybersecurity threats. This combination of people, processes and technology assist us to proactively manage and mitigate threats to our information technology environment. We have controls in place to defend against risks associated with cyber-attacks impacting our operations, compliance and financial reporting objectives. We are externally audited and certified under the ISO 27001 and assessed according to National Institute of Standards and Technology ("NIST") guidelines. Our external partners also evaluate our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats.


text: We conduct a Testing, Training & Exercise program to test, sustain and refine our ability to respond to cybersecurity incidents in accordance with the best practices. We also maintain an information security training program for our employees.


text: Our Third-Party Security Management Standard provides a framework for managing third-party information security risks and defines controls to minimize risks to the Company. It applies to third parties who have access to or process Company information. This framework includes processes for conducting, as appropriate, due diligence, risk assessment and planning, contract management, access control, ongoing monitoring, and possible service termination of, or changes to the third-party as part of the selection and management process.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, like other companies, we and our third-party vendors have on occasion experienced, and will continue to experience, threats to our or their data and systems.


text: Board Oversight of Risks from Cybersecurity Threats The Board of Directors ("Board") oversees risk management related to the operation of the business and corporate functions as well as the implementation of business strategy. Our Board has delegated to the Audit Committee oversight of risk management, which includes risks from cybersecurity threats. We routinely review critical elements of our cybersecurity policies and program with the Audit Committee.


text: The management team – including our Senior Director, Global Information Security – provides periodic reports to the Audit Committee which cover cybersecurity and other information technology risks affecting the Company. Such reports are typically provided at an Audit Committee meeting and enable Audit Committee members to ask questions of management and engage in additional discussions in an open forum. The Audit Committee also periodically evaluates our overall cybersecurity strategy.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Information Security Steering Committee ("ISSC") is responsible for oversight of matters related to information security and currently consists of professionals in legal operations and risk management, information governance, human resources operations, internal audit, computerized systems, global security and technical operations, and research technology, all whose input bring significant value when assessing and managing cybersecurity risk. Our ISSC meets periodically and is presented with an update on cybersecurity matters from our Senior Director, Global Information Security. Our Senior Director, Global Information Security is responsible for facilitating the implementation of the plans and decisions made by the ISSC and directly provides updates to the Audit Committee as detailed above.