text: To address cybersecurity, privacy, and overall business risk adequately, Astrana employs a consistent risk management process that assigns risks to functional owners. Risks can be strategic (e.g., loss of market share, technology shifts), reputational (e.g., loss of trust, revenue decline), regulatory (e.g., regulatory fines, business restrictions), or operational (e.g., operational downtime, productivity loss) in nature.


text: The cybersecurity team collaborates with leaders in management to assess materiality, align on a remediation roadmap, and comply with disclosure requirements. On an ongoing basis, the board of directors and the audit committee oversee Astrana's cybersecurity risks and remediation strategies to prevent and mitigate cyberattacks.

companyName: Astrana Health, Inc.

ticker: ASTH

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: We have developed policies and processes for assessing, identifying, and managing material risk from cybersecurity threats informed by industry-recognized standards. We have integrated these processes into our overall risk management systems and programs. Our cybersecurity program includes, among other things: procedures to assess material risk from cybersecurity threats, protocols to monitor any potential unauthorized access to, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein, mechanisms to safeguard network infrastructure, mandatory employee training on information security, and assessing the sufficiency of existing policies, procedures, systems, controls and other safeguards in place to manage such risks. As part of our risk management process, we have engaged and expect to continue to engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process is also designed to address cybersecurity risks associated with our use of third-party service providers, and includes procedures such as reviewing security audits and controls of these providers during the onboarding process.

companyName: indie Semiconductor, Inc.

ticker: INDI

stage1Category: Risk Management Process


text: In connection with these risk assessments, we design, implement and maintain reasonable safeguards to minimize the identified risks and address identified gaps in existing safeguards, update existing safeguards as necessary and monitor the effectiveness of our safeguards.


text: Our Chief Financial Officer and members of our audit committee are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers that may bring more expertise regarding cybersecurity matters.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL

stage1Category: Management Role

stage1Method: majority


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including as a result of any previous cybersecurity incidents) that have materially affected our business strategy, our results of operations or our financial condition, but there can be no guarantee that we will not experience a cybersecurity incident in the future. We can give no assurance that we have detected or protected against all cybersecurity threats or cybersecurity incidents.

stage1Category: Strategy Integration


text: For further discussion of cybersecurity risks, please see our Risk Factors discussion under the heading, "Risks Related to Our Intellectual Property, Technology and Cybersecurity."

stage1Category: None/Other


text: Our Board of Directors (the "Board") has oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives periodic reports from management concerning our significant cybersecurity threats and risks and the processes we have implemented to address them, and engages in discussions with management regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks. These discussions include a review of our cybersecurity-related risk assessment and risk management policies.


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management, along with our information technology department, is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances. Our information technology department works with management, including the Chief Operating Officer and Chief Financial Officer, to help mitigate and remediate cybersecurity incidents of which they are notified. Our information technology department, led by our director of information technology, includes individuals with over 20 years of prior work experience in various roles involving security, compliance, systems and risk management implementation. In addition, our incident response processes include procedures for reporting material cybersecurity incidents to the Audit Committee for material cybersecurity incidents.


text: Risk Management and Strategy As a healthcare provider, cybersecurity, data protection, safeguarding patient information and the integrity of our information systems is of the utmost priority. We have developed and maintain a Cybersecurity and Data Protection Program which aligns with industry-standard frameworks and applicable regulatory requirements, integrates with our overall risk management process, and aims to ensure cybersecurity concerns are a requisite element for decision-making at all levels of our business.

companyName: RadNet, Inc.

ticker: RDNT


text: RadNet's Cybersecurity and Data Protection Program assesses, identifies and manages threats to our information systems and evaluates cybersecurity risks associated with our vendors and third-party partners. We are focused on detecting, preventing and responding to cyber threats, maintaining the privacy and protection of sensitive information, and maintaining the durability and resiliency of our information and data processing systems.


text: Our approach to designing, operating and measuring the effectiveness of our program leverages experienced internal resources, industry-recognized cybersecurity consultants, assessors, healthcare and industry-specific cybersecurity working groups and threat-intelligence platforms, federal law enforcement and CISA partnerships. We use these resources and partnerships, along with our internal expertise, to develop specialized insights pertinent to our business's cyber-risk, and tailor our cybersecurity strategy to best safeguard our systems and data.


text: We staff an internal cybersecurity team and maintain a third-party managed security operations center which in-concert provide 24x7x365 real-time detection and response. These teams are always connected and routinely respond to perceived threats within minutes. Time to detect and respond metrics are continuously evaluated for opportunities to enhance our program.


text: Cyber-awareness training and testing is a key component of RadNet's Cybersecurity and Data Protection Program. Every employee is required to complete cyber-related training (including third-parties who access our systems) and successfully complete testing throughout the year in addition to monthly phishing tests. Furthermore, we require all system users to complete annual Patient Privacy and Patient Data Breach training and testing to meet RadNet compliance standards.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor-Risks Related to Our Stores and Operations-We and our vendors rely on information technology, and any material failure, inadequacy, interruption or security incident affecting that technology could harm our business, results of operations and financial condition."

companyName: Extra Space Storage Inc.

ticker: EXR


text: We benchmark and evaluate our Cybersecurity and Data Protection Program and data protection maturity against the NIST Cybersecurity Framework and the HIPAA Security Rule. Consistent with these frameworks, our program includes recurring third-party assessments and a vendor risk management program. Our vendor risk management program conducts security assessments to determine a risk profile of potential vendors and third-party partners and integrates ongoing monitoring and periodic re-assessments to ensure compliance with RadNet's security standards. RadNet's Vendor Risk Management Team works closely with RadNet Legal, Compliance and Operations teams to address data safety, compliance and legal requirements for each of our vendor/partner engagements.


text: We continuously evaluate the practical effectiveness of our cyber-defenses both internally and externally using a combination of technology-based assessments and recurring third-party audits. Our Critical Incident Response Team periodically conducts cyber-focused tabletop exercises using scenarios drawn from observations of risk indicators and from threat intelligence reports of real-world incidents affecting our industry. Outcomes and insights from tabletop exercises are used to enhance RadNet's Incident Response Plan which is architected following NIST guidelines and reviewed annually and updated periodically as needed.


text: Our program's overall maturity and operational readiness are regularly evaluated internally by RadNet IT Governance and Compliance teams and by independent expert auditors using the NIST's Cybersecurity Framework. Our program, and the results of the evaluation and testing efforts, are regularly reviewed by our senior management and members of our Board of Directors.


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition. However, cybersecurity threats have the potential to interrupt our operations or cause significant financial hardship. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.


text: RadNet is committed to appropriate cybersecurity governance and oversight. Our Cybersecurity and Data Protection Program is the principal responsibility of our Chief Information Officer and Chief Information Security Officer, each of whom have over 20 years of experience in information systems, including cybersecurity training and experience. Additionally, RadNet's CIO and CISO work closely with our executive management, legal and compliance leaders, and meet regularly to discuss cybersecurity matters and risks.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Audit Committee of our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, and internal audits of our program. Our Audit Committee also receives regular cybersecurity updates and education on a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident report and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards.


text: Risk Management and Strategy The Company maintains a robust enterprise-wide information security program aimed at assessing, identifying, and effectively managing cybersecurity risks, threats, and incidents. The Company has integrated cybersecurity risk management into its broader risk management framework to promote cybersecurity risk management company-wide.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Third-Party Engagement The Company engages a range of third-party advisory service providers, including cybersecurity assessors, consultants, and auditors, to conduct recurrent evaluations of its cybersecurity controls. These reviews are a critical component of the ongoing risk assessment process within the cybersecurity function and include periodic evaluations of internal controls aimed at mitigating cybersecurity threats. These assessments often include penetration tests, evaluations of the Company's cyber program maturity, and assessments of progress toward future-state cyber initiatives, among other considerations. The results of these reviews are reviewed with management and the Company's Board of Directors (the "Board").


text: Oversee Third-party Risk The Company implements processes to oversee and manage the risks inherent with third-party service providers, including conducting thorough security assessments prior to engagement. This is designed to mitigate risks related to data breaches or other security incidents originating from third party providers.

stage1Category: Third-Party Risk


text: Incident Response The Company has implemented internal incident response procedures to address potential cyber incidents. These procedures are designed to analyze, contain, and remediate any cyber incidents that may circumvent existing safeguards. The incident response procedures encompass a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal (including the Board) and external communication and disclosure protocols. The Company also maintains data backup procedures in the event of a cybersecurity incident and for a business continuity plan in the event of business interruption. Examples of our backup procedures include regularly scheduled backups for various systems, critical system log files, and applications backup.


text: The audit committee is primarily responsible for the Board's cybersecurity risk oversight. Management, including the CISO, provide comprehensive briefings to the audit committee on cybersecurity risks on a regular basis, and the audit committee reports to the Board at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the full Board is regularly briefed on updates related Global Information Security Program and the Company's Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions. In addition to scheduled meetings, the audit committee and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain.


text: Management's Role Managing Risk The CISO possesses more than 10 years of relevant expertise in cybersecurity; and holds a Certified Information Systems Security Professional ("CISSP") certification. Other members of the Company's information security team also hold certifications such as CISSP, Certified Information Security Manager ("CISM"), Certified Ethical Hacker ("CEH"), and Certified Information Systems Auditor ("CISA").


text: The Company's Chief Information Officer ("CIO") and CISO work closely with other management positions, including the Chief Financial Officer, Chief Legal Officer, Head of Internal Audit, and Internal Communications, to evaluate cybersecurity risks in alignment with our business objectives and operational needs.


text: The Americold Global Information Security Program is structured to address cyber-related risks in alignment with the guidelines delineated in the National Institute of Standards and Technology ("NIST") security framework. The program also leverages various automated tools, manual processes, and routine periodic third-party assessments to ensure the efficacy of our security measures.


text: Furthermore, the program includes a formal information security training program that includes comprehensive security awareness initiatives and training modules, addressing critical areas such as phishing attacks and best practices for email security.


text: Impact of Cybersecurity Threats As previously disclosed, we have experienced significant cyber incidents in the past, including in April 2023, that have impacted our operations and financial results. The related expense is reflected in "Acquisition, cyber incident, and other, net" on the Consolidated Statement of Operations for the year ended December 31, 2023, and the reserve balance is included in "Accounts payable and accrued expenses" in our Consolidated Balance Sheets as of December 31, 2023. For additional information regarding such risks and the affects thereof on our business strategy, operations and financial condition, see Part I, Item 1A, Risk Factors – "A failure of our information technology systems, cybersecurity attacks or a breach of our information security systems, networks or processes could cause business disruptions and the loss of confidential information and may materially adversely affect our business."


text: The Company has a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, which includes a cybersecurity Incident Response Plan ("IRP"). Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Cybersecurity Risk Identification and Management We design and assess our program based on the Center for Internet Security Critical Security Controls Version 8 (CIS V8). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS V8 controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • third party risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • end-user testing to assess the effectiveness of our security measures; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including mandatory computer-based training, phishing awareness campaigns, and internal communications; • a cybersecurity IRP that includes procedures designed for identifying, analyzing, containing, remedying and otherwise responding to cybersecurity incidents; • testing of our incident response readiness through Disaster Recovery and Business Continuity Plan exercises; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: Cybersecurity risk management is overseen by Ginkgo's Chief Information Security Officer ("CISO"), who is supported by full-time information security staff. The CISO advises the executive team on the development and implementation of the information security program.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: Our management team, including our Senior Vice President of Information Systems and Vice President of Information Security and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team overseeing cybersecurity has over 25+ years of technology and cybersecurity experience and certain of our team hold various cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company is able to identify cybersecurity breaches through various channels, including but not limited to automated event detection alerts, reports from employees, notifications from external entities such as third-party IT service providers, and proactive threat investigations in collaboration with our external partners. Upon spotting a potential cybersecurity breach, including those involving third-party cyber events, the Company's designated incident response team outlined in the IRP adheres to the policy's protocols to investigate the suspected incident. This investigation entails determining the nature of the event (e.g., ransomware attack or breach of personal data), evaluating the severity of the incident, and gauging the sensitivity of any compromised data.


text: In the event of a cybersecurity breach, our primary objective is to swiftly contain it by the procedures detailed in our IRP. Once containment is achieved, our focus shifts to remediation and recovery efforts. These actions are tailored to the specifics of the breach and may involve tasks such as rebuilding systems or hosts, replacing compromised files with clean versions, verifying the integrity of affected files or data, enhancing network surveillance or logging to detect future attacks, adjusting administrative account privileges, fortifying network security like firewall configurations, and providing additional training to employees. Additionally, we carry cybersecurity insurance to cover certain expenses associated with security lapses and specified cyber incidents that disrupt our network or those of our vendors, subject to predefined limits and exclusions.


text: Our IRP includes clear communication guidelines, outlining procedures for engaging executive management, internal and external legal counsel, the Audit Committee, and the Board. These protocols also encompass a framework for evaluating our regulatory reporting obligations to entities such as the SEC in the aftermath of a cybersecurity incident.


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program on a quarterly basis. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Systems as well as our Vice President of Information Security and Compliance, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: As part of our board refreshment efforts in recent years, we have added directors with information technology governance skills. Currently, five members of our board, including all four members of our Audit Committee, have cybersecurity experience from their principal occupation, other professional experience or third-party director education courses on cybersecurity, including cyber risk governance, and data privacy and security issues and trends.


text: Cybersecurity risk management and strategy Ginkgo integrates risk management into its overall cybersecurity strategy, and has implemented processes designed to identify, assess, prioritize and manage risks to protect Ginkgo's data, intellectual property and information assets. As part of our risk governance and management, Ginkgo has developed processes designed to: identify and assess risks, evaluate those risks against pre-defined criteria, develop and implement strategies to address identified risks, monitor and review those risks and communicate risks to relevant stakeholders. Identifying Ginkgo's cybersecurity risks involves a multifaceted approach that encompasses both internal assessments and external information sources. For example, we use security audits conducted by internal and external auditors to assess compliance with security policies and industry frameworks; vulnerability assessments to discover vulnerabilities in networks, systems and applications; penetration testing using simulated cyberattacks to test the resilience of systems and identify weaknesses; and risk assessment processes to evaluate IT infrastructure, including using a risk register to identify risks, likelihood of their occurrence, potential impact, and remediation. We also oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk.


text: Ginkgo incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, Ginkgo has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, "Significant disruptions to our and our service providers' information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us."


text: Cybersecurity governance The Board provides regular oversight of the Company's cybersecurity risk management program. The CISO presents to the Board and the audit committee of our Board (the "Audit Committee") at least annually and quarterly updates via business review dashboards. The Board provides guidance to the CISO, including with respect to any changes to business priorities, risk tolerance, or security initiatives. These briefings are also augmented by ongoing and continuous interactions between the Board and the CISO, as needed.


text: Ginkgo's CISO has primary responsibility for assessing and managing Ginkgo's risks from cybersecurity threats. The CISO has over 20 years of pubic- and private-sector experience in information technology and has served as Ginkgo's CISO since 2018. Executive leadership provides oversight and governance through monthly business reviews of the cybersecurity program.


text: Ginkgo also has a Disclosure Committee, which is composed of representatives from executive leadership from various departments across Ginkgo (e.g., legal, finance, accounting). Their role is to determine materiality of a cyber incident and provide guidance with respect to any disclosure obligations resulting from a cyber incident.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers that includes a diligence and contracting process depending on our assessment of each provider's respective criticality and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Because our products collect and store visitor and related information and images, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Historically, we have not experienced cybersecurity incidents that materially impacted our business strategy, operating results and financial condition but we cannot guarantee a future cybersecurity incident would not materially impact us.

companyName: Vystar Corp

ticker: VYST


text: Our management team, including our Vice President of Cybersecurity and Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and IT has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and IT was the Leader of Global Information Security for New Balance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company has established an information security program to assess, identify and manage material risks from cybersecurity threats, which is an integral part of the Company's overall enterprise risk management program. This program is established at the executive level, with regular reporting to, and oversight by, the Company's Board as described below.

companyName: Uniti Group LLC


text: As part of the Company's information security program, the Company maintains written policies and procedures, such as the Information Security Policy and Company's Incident Response Plan, which identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated. The Company's Information Security Policy identifies security controls, appropriate use, and user responsibilities for the organization that are in place to identify and manage the risk of a cybersecurity incident.


text: The Company has implemented a set of controls to manage information risk, utilizing controls from multiple security frameworks, specifically ISO 27001, and the Payment Card Industry Data Security Standard (PCI-DSS). The Company also conducts various internal and external information risk assessments each year, which are based on nationally accepted standards, including annual compliance required assessments, such as PCI and SOX audits, as well as ad-hoc assessments driven by emerging risks, changes in the Company's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in the Company's risk portfolio and are then prioritized and addressed as needed through the Company's broader information security programs and policies. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, encryption, and vulnerability and patch management.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, we continue to closely monitor cyber risk. To protect its information and cyber assets, the Company conducts appropriate cybersecurity exercises and training. For example, employees must complete cybersecurity training at least annually, which educates our employees on the Company's policies and procedures for incident reporting, and avoiding common cybersecurity threats such as phishing attacks.


text: Additionally, the Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company's information security program, including to conduct risk assessments, vulnerability scans, and penetration testing based on nationally accepted standards. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, such as requiring an independent assessment of the third party's information security controls where appropriate. As part of the Company's process to continuously improve its information security programs, the Company also engages third-party subject matter experts to assess and evaluate the effectiveness of various aspects of the Company's information security program.


text: The Company (or the third parties on which it relies) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Board Governance and Management Cybersecurity risk is managed as an enterprise risk in the Company's enterprise risk management process. At the highest level, the Company's program includes multi-layered governance by management, the Audit Committee and the Board of Directors.


text: carrying cyber risk insurance that provides protection (as specified in the applicable policies) against certain potential costs and losses arising from a cybersecurity incident;

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: Ultimate responsibility for risk oversight and management generally lies with the Company's Board. To effectively manage oversight of our cybersecurity risk management practices, the Board has delegated such responsibility to the Company's Audit Committee. The Company's Chief Information Officer ("CIO") and the information security team provide reports to either the Audit Committee or the full Board on a quarterly basis on various matters, including current and emerging cybersecurity risks to the Company, internal and external assessments of the Company's information security program, and a roadmap of projects to manage its information security posture. In the event of any significant cybersecurity incidents, the Company's Incident Response Plan outlines the process to escalate communications to the Audit Committee and/or the full Board in the event of any significant cybersecurity incidents between the quarterly updates on an ad hoc basis.


text: At the executive and management level, the CIO has primary responsibility for the development, operation, and maintenance of the Company's information security program. The CIO has 19 years of experience in technology risk management, 11 of which have been with the Company (or its affiliates), and has passed examinations and received certifications as a SANS Global Information Security Leader and a Certified Information Systems Auditor. In addition to the CIO, the Company's information security team under the direction of the CIO, implements and provides governance and functional oversight for cybersecurity controls and services. Information security processes include escalation of certain risks and incidents to the CIO and the executive team, with monthly scorecard and quarterly dashboards also used to update the risk landscape.


text: Overall, the Company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of the Company's cyber risk management strategy and the controls designed to protect its operations. In addition, we maintain cyber insurance that is designed to protect us against certain losses related to cyber risks, and we believe the amount and scope of this insurance are customary for similarly situated companies in the telecommunications industry. See ITEM 1A. RISK FACTORS for additional information regarding the Company's cybersecurity risks. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: Risk Management and Strategy Our various corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (our "Information Systems") are necessary for our business. We use these systems, among others, to manage key aspects of our business, including relationships with our tenants and vendors, accounting, acquisitions, internal and external communications and property and asset management. We also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data related to our business (our "Sensitive Data"). We utilize a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.

companyName: Postal Realty Trust, Inc.

ticker: PSTL


text: We and our MSP identify, assess and manage material cybersecurity threats and risks to our Information Systems and Sensitive Data through the following, among others: • a multidisciplinary team, including a dedicated technology committee (the "Technology Committee") comprising members from senior management, asset management and accounting and legal functions, in conjunction with our MSP and other third-party service vendors, to identify, assess and manage cybersecurity threats and risks; • various internal processes and procedures to monitor and evaluate threat environment and our risk profile using methods such as manual and automated tools, subscribing to reports and services that identify and analyze cybersecurity threats, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments; • various technical, physical and organizational processes and policies to manage and mitigate material cybersecurity risks, such as risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training and penetration testing; and • working with third-party vendors from time to time that assist us to identify, assess and manage cybersecurity risks, such as professional services firms and penetration testing firms.


text: For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs. Depending on the nature and risk profile of the services provided and the sensitivity of information processed, we may from time to time conduct a review of the cybersecurity practices of such vendor, contractually imposing obligations on the vendor and conducting periodic reassessments during their engagement. We are currently not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or, to our knowledge, are reasonably likely to materially affect our business, financial condition and results of operations. See to Item 1A. "Risk Factors" in this annual report on Form 10-K, including "We face cybersecurity risks and risks associated with security breaches", for additional discussion about cybersecurity-related risks.


text: In the normal course of business, we proactively manage and monitor cybersecurity activities. To date, these efforts have successfully prevented any incidents that could materially affect our business strategy, operational results, or financial condition. We remain vigilant and are not currently aware of any threats that pose a material risk.

companyName: CuriosityStream Inc.

ticker: CURI


text: Our Board of Directors oversees our strategy and risk management, including material cybersecurity risks. The Audit Committee of the Board of Directors (the "Audit Committee") oversees our cybersecurity and information technology risk exposures, as well as our cybersecurity and information technology policies and programs, in accordance with its charter. The Audit Committee holds quarterly meetings and receives periodic reports from, and also engages in regular discussions with, management and also our MSP regarding our significant cybersecurity risk exposures and the measures implemented to monitor and control these risks. Our Technology Committee also meets at least quarterly to assess cybersecurity risks and prepares reports to the Audit Committee. A number of members of our Technology Committee have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, over their careers at the Company or other organizations.


text: Management is responsible for hiring and overseeing third-party vendors related to cybersecurity and integrating cybersecurity risk considerations into our overall risk management strategy. Our internal cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances and reporting to the Audit Committee for certain cybersecurity incidents, which also allows decisions regarding the public disclosure and reporting of such incidents to be made by management, the Audit Committee and the Board in a timely manner.


text: Risk Management and Strategy The Company is subject to cyber-attacks and information theft risks in our operations, which we seek to manage through cyber and information security programs, training, and insurance coverage. To strengthen our security and cyber defenses, we maintain a defensive approach to cyber and information security designed to defend our systems against misuse, intrusions, and cyberattacks and to protect the data we collect. The Company's processes to assess, identify and manage material risks from cybersecurity threats are strategically integrated into the Company's overall risk management framework, as evidenced by annual risk assessments and required trainings across business lines and applications. The Company's information security program maintains procedures and controls for the systems, applications, and data of the Company and of its third-party providers. The Company has an established cybersecurity training program which is administered through online learning modules and is required for all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of confidential information and asset security, among others, and educate employees on mechanisms in place to report cyber-related incidents or suspicions of cybersecurity threats. Further, the Company maintains a cybersecurity incident response plan, which is managed by the Company's chief information security officer and is reviewed and tested annually. The incident response process is overseen by a security operations and cybersecurity incident response team comprised of members across the organization, including global management and IT operations and leverages an organizational-wide self-service platform that allows the Company to track, manage and resolve information security risks across the organization.

companyName: CORPAY, INC.

ticker: CPAY


text: Our information security program is designed to generally align with recommended practices in security standards issued by ISO, AICPA (SSAE18), National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (ISO 27001 Brazil and U.K.), SOC 1 and 2 Type 2 reports and PCI DSS reports on compliance to adhere to industry standard practices.


text: Our newly acquired businesses maintain separate cybersecurity programs and processes that may differ in scope and complexity from the Company's overall cybersecurity programs and processes.


text: As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to Part I, "Item 1A. Risk Factors."


text: Use of Third-Parties To regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address cyber-related issues, the Company engages with information security and forensics firms with specialized industry knowledge. Our collaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and testing, and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties, regulators, and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized access to our processing systems.


text: In order to oversee and identify risks from cybersecurity threats associated our use of third-party service providers, we maintain a risk management program designed to help protect against the misuse of information technology. In addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity, regulatory and industry requirements.


text: The Board of Directors oversees the Company's information security and risk management program. To support effective governance in managing risks related to cybersecurity, the Board has established an information technology and security committee.


text: Board of Directors Oversight The information technology and security committee is responsible for providing oversight and leadership for our information technology security and cybersecurity, planning processes, policies and objectives. The information technology and security committee is composed of board members with both industry knowledge as well as expertise in technology and security, finance and risk management. The primary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global information security and the evolution of our technology in a competitive environment.


text: To accomplish this purpose, the information technology and security committee has five primary responsibilities: • understanding the security controls and assessments conducted on our major payment platforms and comparing them to industry best practices; • evaluating strategies to protect our intellectual property; • assessing opportunities to update our processing platform strategies to ensure the long term use of our resources; • reviewing progress on significant IT security and cybersecurity projects and evaluating effectiveness of projects; and • overseeing our disaster recovery and business continuity plans.


text: Management's Role The Board and the information technology and security committee directed the formation of a cross-functional cybersecurity council at the Company, and receive regular cybersecurity reports from the global CIO, the corporate CIO and the chief information security officer (CISO), among others. These reports include updates on the Company's cybersecurity strategy and execution of its processes, including updates on procedures to prepare for, prevent, detect, respond to and recover from (as applicable) cyber incidents. Such updates also include updates on the Company's continued compliance with regulatory requirements. The Company's information security and risk management program is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.


text: Our CISO, who reports directly to the Company's Chief Information Officer ("CIO"), has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems Auditor.


text: Our CISO manages the Company's information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cyber threat detection and incident response. Our CISO promptly informs and updates the Board about any information security incidents that may pose a significant risk to the Company.


text: We have a thorough process for identifying, assessing, and managing cybersecurity risks within our broader risk management framework. We gather insights from external experts and internal threat intelligence teams for our cybersecurity risk management program. A dedicated team oversees cybersecurity risk management, led by professionals with deep expertise, including our Vice President, Cybersecurity and Information Security Officer. Our executive leadership, supported by our cybersecurity team, oversees our enterprise risk management and regularly considers cybersecurity and other material risks.

companyName: BIOLIFE SOLUTIONS INC

ticker: BLFS


text: Within our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company and third-party service providers. Significant incidents undergo review by a cross-functional group, with immediate escalation for potentially material incidents. We consult with outside counsel as needed, with final decisions made by senior management.


text: The Audit Committee oversees cybersecurity risks and incidents, ensuring compliance with disclosure requirements and cooperation with law enforcement. Senior management regularly updates the committee on cyber risks and any material incidents.


text: While our business strategy and financial condition have not been materially affected by cybersecurity risks, we cannot guarantee future immunity. For more details, refer to Item 1A Risk Factors in our Annual Report on Form 10-K.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical information technology and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer and employee data ("Information Systems and Data").

companyName: Sweetgreen, Inc.

ticker: SG


text: Our Chief Technology Officer ("CTO"), as well as the security operations, engineering, risk management and legal functions help identify, assess and manage the Company's cybersecurity threats and risks. Our security operations team monitors and identifies potentially material cybersecurity threats and risks, implements and maintains the Company's incident management policies and plans. Our security operations team leads our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, subscribing to reports and services that identify cybersecurity threats, monitoring incident notifications from stakeholders, conducting threat assessments, managing software vulnerabilities and patches, conducting tabletop incident response exercises, and, in connection with our legal function, coordinating with law enforcement concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; vulnerability management activities; encryption of data; network security controls; data access controls; penetration testing; cybersecurity insurance; and a dedicated security operations team.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provides an annual cybersecurity update to each of the board of directors and the audit committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as account management, payment processing, cloud-based infrastructure, data center hosting, and content delivery to customers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If the confidentiality, integrity, or availability of our information technology, software, services, communications, or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight, mitigation, and disclosure of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO and members of our legal and cybersecurity teams. Our CTO has more than three decades of experience working in technology for global companies in the technology, retail, and food services industries and has served in senior management at another public food service company.


text: Senior management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Senior management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity policies and processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Legal Officer, and Chief Financial Officer. The Chief Legal Officer works with the Company's cybersecurity incident response team to help the Company mitigate and remediate cybersecurity incidents of which he is notified. In addition, the Company's incident response process includes reporting material incidents to the audit committee of the board of directors.


text: The audit committee and the full board receive annual reports from senior management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to certain cybersecurity threats, risks, and mitigations.


text: Oversight and Governance Our cybersecurity risk management program is a significant part of our overall risk management program, which has been delegated by our Board of Directors to the Audit Committee of the Board of Directors ("Audit Committee"). As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing, assessing, and considering, in consultation with management and the Board, as appropriate, the overall risk management policies and procedures of the Company, including our major risk exposures such as cybersecurity.

companyName: Prime Medicine, Inc.

ticker: PRME


text: The Fund depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, administrative agents, fund administrators and other third parties to source, make and manage its investments. Accordingly, the Fund's business is dependent on the communications and information technology ("IT") systems that it shares with the Advisers and their ultimate parent company, TIAA, which further relies upon the systems of third-party IT service providers to TIAA. TIAA has established a cybersecurity program across its enterprise, which applies to certain of its affiliates, including the Advisers and the Fund. When identifying and overseeing risks from cybersecurity threats associated with its use of third-party service providers, the Fund further relies upon the expertise of risk management, legal, information technology, and compliance personnel of TIAA. TIAA conducts onboarding and ongoing due diligence of certain of the Fund's key third-party service providers to identify and oversee risks from cybersecurity threats associated with the Fund's use of such entities.

companyName: Nuveen Churchill Private Capital Income Fund


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Fund and the Advisers. This cyber risk management program is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Fund and other affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund and the Advisers in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Fund, the Advisers and their respective third-party service providers.


text: TIAA's cybersecurity team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Fund and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Oversight of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund is assessed on an ongoing basis, as well as how such risks could materially affect the Fund's business strategy, operational results, and financial condition. Cybersecurity risk remains heightened to the financial industry, including the Fund, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Fund's operations. TIAA and the Advisers continue to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers. The Fund has not experienced any material cybersecurity incident, and the Fund is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.


text: TIAA's cybersecurity team periodically reports to the Fund's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Fund, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Board receives periodic updates from the Fund's management regarding TIAA's cybersecurity program, information on current threat landscape and risks from cybersecurity threats and cybersecurity incidents impacting the Fund.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees and violation of data privacy or security laws.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Bloom Energy Corp

ticker: BE


text: Risk Management and Strategy Teams of internal and third-party cybersecurity professionals oversee cybersecurity risk management, which is based on the National Institute for Standards and Technology Cybersecurity Framework: • Identify – Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. • Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. • Detect – Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. • Respond – Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. • Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes that is centered on three key components: • Identification of risks: We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. • Assessment of threats: We assess organization vulnerabilities and the likelihood that the risk scenarios could occur, including risk assessments of our existing systems, penetration testing, and other vulnerability analyses. This assessment also extends to critical third parties, such as contract research organizations, prior to being approved to work with the company, and includes reviews of Service Organization Control Type 2 reports. • Execute: Internal and third-party experts coordinate implementation of necessary security controls to prevent or reduce the risk of security vulnerabilities from being exposed.


text: We also maintain an ongoing end-user cybersecurity awareness program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions, including quarterly training and simulated phishing campaigns.


text: The Audit Committee and Board of Directors receive routine updates from senior management, including leaders from our information technology and legal functions regarding matters of cybersecurity. These updates include existing and new cybersecurity risks, status on how management is addressing and mitigating those risks, cybersecurity and data privacy incidents, if any, and status on key information security initiatives.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: We retain a chief information consultant and a third-party security management vendor to help identify, assess and manage our cybersecurity threats and risks. These partners identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example, automated tools, cybersecurity threat subscription services, threat report analysis, internal and external audits, and threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our security management partners work with our Chief Financial Officer to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, our Chief Financial Officer evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity software providers and penetration testing firms. These third-parties also provide application and hosting services. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments and audits for each vendor and a review of each such vendor's written security program.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our information security consultant and third-party managed service provider. Our information security consultant has over 40 years of experience in pharmaceutical information technology, including many years as a chief information officer.


text: Our Chief Financial Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our information security partners, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer and legal department. Our Chief Financial Officer works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We operate in the medical device industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have initiated a risk-based approach designed to identify and assess the cybersecurity threats that could affect our business and information systems. Our strategy is to maintain a high level of risk awareness, identify critical IT assets, regularly update or replace those assets, and systematically perform vulnerability testing, and to promptly remediate deficiencies. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: NeuroMetrix, Inc.


text: We are adopting various tools and methodologies to manage cybersecurity risk that will be tested on a regular cadence. We are also in the process of monitoring and evaluating our cybersecurity posture and performance on an ongoing basis through scheduled vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.


text: Our Board of Directors, the Audit Committee and the Cyber Committee, which is chaired by the Chief Executive Officer and staffed by the IT Director, Chief Financial Officer, Corporate Controller and other management employees, are responsible for overseeing cybersecurity risks and risk management. The Board has assigned oversight responsibility for cybersecurity to the Audit Committee, which is in regular communication with management concerning cybersecurity threats and incidents. The Audit Committee reviews management assessment of cyber controls, control testing and outcomes. The Audit Committee is responsible for keeping the Board informed of significant cybersecurity developments including incidents which might potentially have a material effect on the Company. The Cyber Committee is responsible for evaluating cyber threats, the potential effect on operations and scope of the threat. Threats or incidents which the Cyber Committee has judged to have potentially material consequences will be communicated to the Audit Committee. A meeting of the full Board of Directors, including the Audit Committee, will be convened within 48 hours of the Cyber Committee assessment. If the Board determines that the threat or incident is material, Form 8-K will be finalized and filed within four days following the determination, as required under SEC rules. The Company is currently in the process of implementing a more formalized cybersecurity program.


text: Incident Management. We have a documented incident response plan for identifying and responding to cybersecurity incidents that focuses on isolating, containing, mitigating, and eradicating the threat as quickly as possible. In the event of a cybersecurity incident, we will follow a documented incident escalation procedure. For a discussion of whether any cybersecurity risks have, or are likely to materially affect us, please see 1A, Risk Factors, for a discussion of identified cybersecurity risks.

companyName: OneSpan Inc.

ticker: OSPN


text: Risk Management and Strategy The Company employs a comprehensive, cross-departmental approach to continuously assess, identify, and manage potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the information technology ("IT") security team, which is led by our Chief Information Security Officer ("CISO"), the Information Security Steering Committee ("ISSC"), which is chaired by our CISO and comprised of executive and senior representatives from key corporate functions as overseen by the Board of Directors, primarily through the Audit Committee. The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management program and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: Our cybersecurity risk management program categorizes cybersecurity risks into five areas: identify, protect, detect, respond, and recover. We regularly assess the cybersecurity threat landscape, employing a layered cybersecurity strategy that emphasizes prevention, detection, and mitigation through a variety of technical and operational measures. As a part of our cybersecurity risk management program, our information security program is tailored to address identified risks, while aligning with pertinent business requirements.


text: We foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training to enhance awareness and readiness against potential cyber threats. Certain roles require additional role-based, specialized cybersecurity training, such as tabletop exercises to ensure proactive preparation and effective coordination in the event of a security incident. We engage a third-party to conduct annual tabletop exercises in order to rehearse our incident response plan, as well as to identify and prioritize opportunities for improvement within our cybersecurity program and associated security controls, through a customized simulation specifically tailored to our current environment, processes, and procedures. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. Our IT security team reviews and updates such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.


text: We continually seek to update our IT security, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts to evaluate the efficacy of our security measures. We engage reputable third parties to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness. Risks from cybersecurity threats, including as a result of previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, have not materially affected, and are not currently viewed as reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the ISSC and the Audit Committee. Our CISO possesses over 24 years of experience in various technology, cybersecurity operations, and engineering roles, holds a bachelor's degree in computer information science and a master's degree in technology management, earned a CISO Certificate from Carnegie Mellon University, and is ISC2 CISSP certified.


text: Other key members of management assist our CISO in the oversight of cybersecurity risk management through their membership in the ISSC, which is chaired by our CISO and is comprised of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, President of Direct-to-Consumer, and Global Digital, Privacy Counsel, and our Vice President of Internal Audit. The ISSC reviews and discusses comprehensive quarterly and annual reports from our CISO and the IT security team in order to provide cooperation, collaboration, and consensus driven information security guidance to the IT department and the Company as whole.


text: We have also established an Incident Response Team (the "IRT"), which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed, to identify and assess security incidents, including the impact and severity of such incidents. Upon the identification of a security incident, the IRT performs an impact analysis and then determines the appropriate course of action, which may include escalation to the ISSC. Upon consultation with the ISSC and consideration of the relevant risks, the IRT will determine whether the incident should be communicated to the Audit Committee of the Board of Directors.


text: Our management team, including our VP of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management policies and procedures and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our VP of IT, who has experience across technology-enabled growth, information security, infrastructure, operations and compliance.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: Board of Directors The Audit Committee of the Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Audit Committee reviews quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, any newly-identified risks, existing projects, and key performance insights and engages in discussions with management based on such reports and other recent developments.


text: The Company maintains an Information Security Program which is designed to ensure the confidentiality, integrity, and availability of all data and systems across the organization. We have developed a system of processes and controls to mitigate risks and respond effectively to security incidents.

companyName: Eagle Bulk Shipping Inc.


text: Key components of our Information Security Program include: • Risk Management: We conduct regular risk assessments to identify, evaluate, and prioritize potential threats and vulnerabilities. Based on our understanding of the risk landscape relevant to the Company, we have implemented targeted controls and allocated resources to mitigate risks to an acceptable level. • Policies and Procedures: Our Information Security Program is supported by a set of clear and enforceable policies and procedures. These documents outline standards for data handling, access control, password management, incident response, and other critical security practices. We regularly review and update our policies and procedures to ensure alignment with industry best practices and regulatory requirements. • Access Control: We enforce strict access controls, which include role-based least-privileged access, strong authentication methods and regular access reviews to limit system and data access to authorized personnel only. • Security Awareness Training: We believe that our employees are our first line of defense against cyber threats. We provide comprehensive security awareness training programs to educate staff about common risks, phishing attacks, social engineering tactics, and best practices for maintaining a secure information technology environment. We also provide security updates and alerts to keep our employees informed of active and emerging external cybersecurity threats. • Technical Controls: Our Information Security Program incorporates a layered approach to technical controls. This includes firewalls, intrusion detection and prevention systems, endpoint protection, encryption mechanisms, and continuous monitoring tools to detect and respond to security incidents in real-time. • Incident Response and Business Continuity: Despite our proactive measures, we recognize that security incidents may still occur. Therefore, we maintain a robust incident response plan, detailing procedures for detecting, analyzing, containing, and recovering from security breaches. Additionally, we have comprehensive business continuity and disaster recovery plans in place to ensure minimal disruption to our operations in the event of a cybersecurity incident. • Compliance and Auditing: Our Information Security Program is designed to comply with relevant regulations and industry standards. We undergo regular internal and external audits to assess our adherence to these requirements and demonstrate our commitment to maintaining a strong security posture.


text: Our Information Security Program is led by our Director of Global Information Technology, who has over 20 years of relevant educational and technical experience. The Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. We have integrated cybersecurity risk into our disclosure controls and procedures. The Audit Committee of the Board of Directors regularly reviews and discusses with management risks related to our information systems, information security, data privacy and cybersecurity risks and the Company's risk assessment and risk management programs and the steps management has taken to monitor and control such exposures. The Audit Committee also receives, at least quarterly, updates from the Director of Global Information Technology and senior management regarding material information regarding the Company's information systems, information security, data privacy and cybersecurity.


text: We continuously monitor emerging threats, evaluate new technologies, and refine our security practices to manage evolving risks. Through regular assessments, audits, and feedback mechanisms, we strive for continuous improvement in our Information Security Program to better protect our assets and maintain the trust of our stakeholders.


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. However, we are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions. Cyber intrusions require a significant amount of time and effort to assess and remedy, and our incident response efforts may not be effective in all cases. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors - Cybersecurity incidents or other security breaches involving our computer systems or the systems of one or more of our vendors could materially and adversely affect our business.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the International Organization for Standardization ("ISO") 27001 Framework and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such standards, including the ISO 27001 Framework, as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: FuboTV Inc.

ticker: FUBO


text: Our cybersecurity risk management program is supported by both management and our Board of Directors, and is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, which are then used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our management team and Audit Committee on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • periodic assessment and deployment of security tools and technical safeguards designed to protect our information systems from cybersecurity threats; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • controls designed to identify and manage cybersecurity threats associated with our use of third-party service providers, suppliers and vendors with respect to our critical systems and data.


text: We have not identified any cybersecurity threats, including as a result of prior incidents, that as of the date of this Annual Report have materially affected us, or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. However, there can be no guarantee that such controls, policies and procedures will be fully implemented and properly followed in every instance, or that those investments or policies and procedures will be effective. We therefore can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors—Risks Related to Privacy, Consumer Protection and Cybersecurity—Any significant interruptions, delays or discontinuations in service or disruptions in or unauthorized access to our information technology systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, including subscriber and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.