text: Risk Management and Strategy The Company has an enterprise risk management program to identify, assess, monitor, and manage significant risks of the Company. The Company evaluates cybersecurity risks alongside other critical business risks under this program, and the Company also has a standalone cybersecurity program. The Company's approach to assessing, identifying, and managing material risks from cybersecurity threats is grounded in established frameworks, including those set forth by the National Institute of Standards and Technology (NIST) and other industry standards and requirements as defined by various compliance frameworks. Our cybersecurity program prioritizes key areas such as: • Policies, Standards, and Practices: We maintain comprehensive policies, standards, and practices aligned with industry practices and regulatory requirements. These documents serve as the foundation for our cybersecurity program, providing clear guidelines for safeguarding our information systems and data assets. • Threat Monitoring and Assessment: Continuous monitoring and assessment of cyber threats and vulnerabilities are integral to our risk management strategy. We utilize advanced monitoring tools and threat intelligence sources to proactively identify and address potential security risks. The Company uses third-party service providers to support its operations. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. • Audits and Assessments: Regular audits and assessments are conducted by both internal and external experts (consultants, auditors, and other third parties) to evaluate the effectiveness of our cybersecurity controls and processes and recommend improvements. These assessments help us achieve compliance with internal policies as well as external regulations and standards. • Incident Response Planning: We have developed comprehensive incident response plans to mitigate cybersecurity incidents. These plans outline clear procedures for detecting, responding to, and recovering from security breaches, minimizing the impact on our operations and stakeholders. External technical, legal, and law enforcement support is engaged as needed to support response efforts.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: The Company employs a multifaceted approach through in house capabilities and in partnership with external cybersecurity experts to safeguard its assets, including technical and organizational measures. These include the deployment of technology focused on identifying and remediating threats, ongoing employee training exercises, regular incident response capability reviews and exercises, cybersecurity insurance coverage, and business continuity mechanisms.

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our Board, with the assistance of our Audit Committee, oversees the Company's cybersecurity program and strategies. The Audit Committee receives regular reports and updates, typically quarterly, from our Chief Technology Officer (CTO) on a wide range of cybersecurity topics. These reports include detailed insights into risk assessments, mitigation strategies, emerging threats, vulnerabilities, incidents, and prevailing industry trends. After each such report, the Chair of the Audit Committee updates the full Board for transparency and accountability in cybersecurity governance. Additionally, at least annually and as needed from time to time, the Board receives similar cybersecurity updates directly from the CTO. Further, the Board oversees cybersecurity as part of our enterprise risk management program.

stage1Category: Board Governance


text: To further bolster the Board's understanding of cybersecurity issues, management facilitates ongoing educational opportunities. For instance, in December 2023, the Board engaged in a discussion with cybersecurity experts on building resilience to cyber risk. These educational initiatives empower Board members to make informed decisions and actively contribute to the oversight of cybersecurity governance.


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support the assessment of cyber related risks, including to conduct cyber penetration testing.

companyName: ZW Data Action Technologies Inc.

ticker: CNET


text: Our CTO, supported by our Vice President of Infrastructure and Security, assumes primary responsibility for assessing and managing material cybersecurity risks. With over 25 years of experience spanning restaurant, retail, and technology brands, our CTO brings a wealth of expertise to the role. Having previously held similar positions leading and overseeing cybersecurity programs at both private and public companies, our CTO is well-equipped to navigate the complex landscape of cybersecurity threats and challenges.

stage1Category: Management Role

stage1Method: majority


text: Our Company has established robust policies and processes governing the assessment, response, and notifications associated with cybersecurity incidents. These protocols ensure a systematic and coordinated approach to incident management, with collaboration among engineering, legal, and senior leadership to oversee compliance with legal and regulatory requirements and have clear mechanisms in place for escalating notifications to our CEO and the Board based on the nature and severity of each incident.


text: While we have experienced cybersecurity incidents in the past, in the last fiscal year we have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

stage1Category: Strategy Integration


text: Our Board, with the assistance of our Audit Committee, oversees the Company's cybersecurity program and strategies. The Audit Committee receives regular reports and updates, typically quarterly, from senior management on a wide range of cybersecurity topics. These reports include detailed insights into risk assessments, mitigation strategies, emerging threats, vulnerabilities, incidents, and prevailing industry trends. After each such report, the Chair of the Audit Committee updates the full Board for transparency and accountability in cybersecurity governance. Additionally, at least annually and as needed from time to time, the Board receives similar cybersecurity updates directly from senior management. Further, the Board oversees cybersecurity as part of our enterprise risk management program.


text: To further bolster the Board's understanding of cybersecurity issues, management facilitates ongoing educational opportunities. The Board routinely engages in discussions with cybersecurity experts on building resilience to cyber risk and receives updates regarding management tabletop exercises. These educational initiatives empower Board members to make informed decisions and actively contribute to the oversight of cybersecurity governance.


text: Currently, our Vice President of Infrastructure and Security assumes primary responsibility for assessing and managing material cybersecurity risks. With experience spanning restaurant, retail, financial, and technology brands, including serving in similar roles overseeing information security programs at other companies, and a degree in Computer Science, our Vice President of Infrastructure and Security brings experience and expertise to the role. Our Vice President of Infrastructure and Security leads a team of professionals who oversee the prevention, detection, and remediation activities within our cybersecurity environment.


text: The Company has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; and an incident response program documenting cybersecurity incident response and notification procedures. The Company's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Information Security Review Committee (ISRC) and the Information Systems Steering Committee (ISSC). The ISO has several years of professional experience in cybersecurity and vendor management, and holds multiple relevant professional certifications. The ISO provides an update to the Board of Directors on a quarterly basis. The Information Security Program is approved by the Board annually.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: The ISO maintains risk assessments for key IT systems. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are also used annually to assess cybersecurity risk.


text: Third parties are assessed and categorized according to service type, compliance risk, financial risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on inherent risk as well as specifics such as if the vendor hosts data in the cloud or has access to consumer information.

stage1Category: Third-Party Risk


text: The Company uses a training system to educate new and existing employees on cybersecurity risks. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks.


text: The Company uses data loss prevention and web filtering software to ensure malicious data does not enter the Company's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. All Company networks are secured behind firewalls. Additionally, Security Information and Event Management (SIEM) technology, an Intrusion Detection System (IDS), and an Intrusion Prevention System (IPS) are used.


text: Access to data on the Company's networks is granted only if needed for job functions. Data Security Analysts review changes to access to ensure they are authorized and appropriate.


text: An Incident Response Committee that includes representatives from key areas of the Company meets in the event of cybersecurity incidents. The Committee ensures the proper notifications are made in order to comply with all relevant laws, rules and regulations.


text: During the year ended December 31, 2023, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Company. For discussion of the risks from cybersecurity threats, including potential impact to the Company's business strategy, results of operations, and financial condition, refer to "Item 1A – Risk Factors – The Company's information systems may experience an interruption or breach in security" in this Report, which is incorporated by reference in this paragraph.


text: Risk management and strategy The Company employs a multi-faceted approach to assess, identify, and manage material risks from cybersecurity threats. Components of our approach include the following:

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: The use of a cyber risk matrix that assesses the likelihood and impact of threats and risks identified in the Company's hardware, software, and data systems. Threats are ranked by potential severity and mitigation / remediation efforts are tracked. Matrix is updated on a semi-annual basis and as new risks are identified. System penetration testing is performed by rotating third-party service providers at least every 18 months. System vulnerability testing is performed by the Company monthly. Network assessments are performed at least annually by qualified third-party service providers.


text: Monitoring of Federal government alerts (CISA, FBI) and industry threat information is performed to stay current on the newest cybersecurity threats bad actor tactics.


text: Multifactor authentication is required for all authorized users to access network resources which adds a second layer of protection from unauthorized entry to our systems.


text: The cybersecurity risk assessment process is part of the Company's overall risk management process. As noted above, the Company utilizes third-party consultants and services in our process of assessing and managing cybersecurity risk. To mitigate the risk of cybersecurity threats related to the use of third-party service providers, the Company obtains and reviews System of Organization Controls (SOC) reports from third parties when available, to provide assurance that the third-party has appropriate controls in place and has not identified any significant cyber issues. The Company does not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. See Item 1A "Risk Factors" for a summary of certain cybersecurity risks.


text: While general risk assessment and management oversight resides with the Company's Audit Committee, oversight of risks from cybersecurity threats resides with our Board of Directors. The Company's Audit Committee is in charge of reviewing the Company's information security disclosures and incident reporting related to cybersecurity. The Company's Board of Directors is in charge of reviewing the Company's information security procedures and evaluating management's assessment of materiality for cyber incidents. The Board of Directors is formally updated on cybersecurity risks by the VP of Information Technology no less than annually. Management is responsible for assessing and managing material risks from cybersecurity threats. This responsibility primarily resides with the VP of Information Technology and his qualified team, including dedicated cyber security personnel. The qualifications of the Information Technology team include a combination of formal education (e.g. degrees in Information Assurance, Computer Information Systems, Computer Networking, and current enrollment in a Cyber Security degree program); current trainings and certifications in systems, network and cybersecurity; and, over 100 years of combined Information Technology experience. Management's process for monitoring prevention, detection, mitigation, and remediation of cybersecurity incidents is summarized above in the Risk management and strategy section.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the Information Technology Steering Committee and our board of directors.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of internal and external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, Federal Financial Institution Examination Council Cybersecurity Assessment Tool, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Information and Operations Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The Information Security Program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions and maturing our Information Security Program.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of tools and processes to identify, protect against, detect, respond, recover from, and govern cybersecurity risks and threats. We have tools configured to block, prevent, detect, and monitor for suspicious activity providing real time monitoring and alerts for anomalous and nefarious activity, as well as advanced persistent threats. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We actively monitor our email traffic for malicious phishing email campaigns, provide ongoing training for employees to help them detect possible malicious emails and monitor remote connections. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our Information Security Program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer. Key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company.


text: Our Information Security Officer is accountable for overseeing and directing our Information Security Program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has over ten years of information security experience and four cybersecurity related certifications.


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees generally meet monthly and quarterly, respectively, to provide oversight of our risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Information Technology Steering Committee on a monthly basis (or more frequently as may be required by the Incident Response Plan).


text: The Information Technology Steering Committee is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Information and Operations Officer provide regular reports to the Information Technology Steering Committee and our board of directors regarding the Information Security Program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee and our board of directors review and approve our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full board of directors at each board meeting.


text: Cyber Risk Management and Strategy We rely on information technology and data to operate our business and develop, market, and deliver our products to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, manufacturing equipment and processes, lab equipment, software, and our critical data including confidential, personal, proprietary, financial and sensitive data. Accordingly, we maintain certain risk assessment processes intended to identify risks from cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: We use a layered approach designed to mitigate the constantly evolving risks from cybersecurity threats by investing in people, processes, and cybersecurity technologies. Our approach is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the Center for Internet Security, or CIS, critical security controls.


text: Our cybersecurity risk management program leverages trusted technology partners and solutions in an effort to identify and track key cybersecurity risks. This program includes period security assessments conducted in collaboration with our key stakeholders, penetration testing and vulnerability assessments, and a mandatory cybersecurity training program for employees. To manage cybersecurity incidents, our global security operations team maintains a cybersecurity incident response plan, conducts readiness exercises, and takes steps to improve the program, as appropriate, to manage the changing threats faced in our industry.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors. We apply mitigations and processes based on our evaluation of the criticality of the vendor and the sensitivity of the data the vendor accesses. Our current vendor evaluation procedures include, as appropriate, an assessment prior to onboarding and implementation of cybersecurity-specific contract provisions. We are in the process of expanding and maturing these vendor risk management procedures.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Risks from cybersecurity threats have, to date, not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition; however, from time to time, we have experienced threats and security incidents relating to our and our third party vendors' information systems. For additional information, please see the section captioned "Part I. Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Vice President of Information Technology, or VP of IT, is responsible for the direction of our information technology organization. Our VP of IT has over twenty-five years of cybersecurity and incident management experience. Our VP of IT is supported by a third-party virtual chief information security officer, or vCISO, who also has over twenty-five years of cybersecurity experience. Our VP of IT, supported by our vCISO, assesses our cybersecurity risks through regular meetings with our IT team, and escalates cybersecurity matters as needed to management.


text: The role of the Board of Directors in our risk oversight process includes receiving reports from management and the chairs of Board committees on areas of material risk to our Company, including cybersecurity risks. The Board has delegated primary responsibility to the Audit Committee to review these matters. As established in the Audit Committee Charter, the Audit Committee oversees cybersecurity risks by reviewing reports, summaries and presentations on data management and security initiatives and significant existing and emerging cybersecurity risks. This includes material cybersecurity incidents, the impact to us and our stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents. Our VP of IT presents on risks from cybersecurity threats to the Audit Committee at least annually and to the full Board, as necessary.


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented and maintain a security risk management program that is designed to preserve the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and our vendors have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the section entitled "Risk Factors — Risks Related to Information Technology and Data Privacy".

stage1Category: None/Other


text: Risk Management and Strategy We have implemented internal controls including regular risk assessments designed to address financial, operational and information technology (including cybersecurity) risks and controls across our organization. These assessments are overseen by our Director of IT and VP of Finance. We implement cybersecurity controls and procedures designed to address cyber risks and threats, supported by third-party technologies and security advisors and providers. We also provide cybersecurity awareness training to our employees during the onboarding process and periodically thereafter. In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments, and to evaluate our overarching information security program and specific incident response procedures. We also maintain a Cyber Incident Response Plan, which is overseen by our Director of IT and is designed to coordinate our response to information security incidents.


text: Cybersecurity Oversight The Director of IT is responsible for implementing and maintaining the information security program. The Director of IT role is currently held by an individual who has more than 20 years of professional IT management experience and maintains a Global Information Assurance Certification. The Director of IT reports to our VP of Finance, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our VP of Finance meets with the audit committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of the risk remediation and ongoing implementation of cybersecurity improvements across our organization.


text: Management also generally provides quarterly updates to the audit committee on cybersecurity and other information technology risks. We have implemented a process for the Director of IT and the VP of Finance to receive incident reports and report quarterly (and, if applicable, in the event of a cybersecurity incident), to our internal disclosure committee and the audit committee, as appropriate. Management presents to the entire board of directors on an annual basis, including any key findings identified in our cybersecurity assessments.


text: We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our Board of Directors.

companyName: UNITED GUARDIAN INC

ticker: UG


text: Risk Management and Strategy We have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive annual cybersecurity awareness training, including specific topics related to social engineering and email frauds. We utilize an outsourced information technology firm and consultants with significant expertise in cybersecurity. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our Information Technology General Controls are firmly established based on the National Institute of Standards and Technology ("NIST") cybersecurity framework and cover areas such as risk management, data backup, and disaster recovery. We have utilized an outsourced information technology consultant to reduce and monitor security threats and vulnerabilities. As part of our gap analysis, identified vulnerabilities have been, and will continue to be, promptly addressed with our senior business leadership and our Board of Directors.


text: Our Board of Directors is responsible for overseeing our cybersecurity risk management and strategy. Our President regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: RISK MANAGEMENT AND STRATEGY We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: Our cybersecurity risk management program is designed to identify, assess, and manage the cybersecurity risks that are relevant to our business and is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: carrying cyber risk insurance that provides protection (as specified in the applicable policies) against certain potential costs and losses arising from a cybersecurity incident;


text: regular communications to all employees from management informing of the types of threats to be aware of and procedure to follow when a risk has been identified;


text: requiring employees, as well as contractors who have access to our systems or the data of our employees or customers, to treat information as confidential.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not currently engaged any third party service providers to support, manage, or supplement our cybersecurity processes.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for the Company's Board of Directors and management.


text: The Audit Committee of the Company's Board of Directors is responsible for the oversight of risks from cybersecurity threats. The Audit Committee periodically receives updates from management and our third party IT support specialists of our cybersecurity threat risk management and mitigation strategies covering topics such as data security posture and potentially material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the company's plans to mitigate those risks, and discusses such matters with our third party IT support specialists and other members of senior management. Potentially material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management.


text: While the Audit Committee reviews and oversees the Company's information security efforts, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: To its knowledge, the Company has not experienced a material cybersecurity breach within the last three years, nor identified any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition.


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity attack or incident, such as a data breach, ransomware, malware, phishing, or other form of cybercrime, could adversely affect our operations, customer service, product development, and competitive position. Such incidents may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. They could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.

companyName: PSYCHEMEDICS CORP

ticker: PMDI


text: At Psychemedics, the Vice President of Information Technology also serves in a dual capacity as the Chief Information Security Officer (VPIT & CISO) overseeing our information security program. The VPIT & CISO's team is tasked with the development and implementation of cybersecurity strategy, policy, standards, architecture, and processes. Our cybersecurity program is aligned with industry standards and best practices, such as the CIS Critical Security Controls ("CIS 18") Implementation Group 1 ("IG1") guidelines. We maintain an incident response and recovery plan, including measures for responding to and recovering from cybersecurity incidents. To minimize the threat surface, we strategically limit the use of third-party service providers with access to personal, confidential, or proprietary information. Also, we evaluate these providers and take steps to help mitigate risks associated with their use and minimize the potential for supply chain attacks. Employing a risk-based approach, we are committed to continuously reassessing our cybersecurity posture and improving our defenses in response to evolving and emerging threats. While we have not experienced any known material incident in the past year, we acknowledge that we have limited resources dedicated to identifying and mitigating cybersecurity risks and that an information security plan is not infallible.


text: At least twice each calendar year, the VPIT & CISO will report on the health and status of our information security program to our Board of Directors, or a committee thereof, as well as to our Chief Executive Officer and other members of our senior management as appropriate. These reports typically include a high-level overview of current and emerging cybersecurity risks; an assessment of the organization's overall security posture; incident reports; an update on our compliance with relevant cybersecurity laws, regulations, and standards; an overview of ongoing and planned initiatives to strengthen the organization's cybersecurity defenses; and strategic recommendations.


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board exercises oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are integrated into our ERM program and are based on frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Axe Compute Inc.

ticker: AGPU


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: Governance. As discussed in more detail under the heading "Governance," the Board maintains an active role concerning cybersecurity risk management including oversight of the Company's employee personnel with extensive experience in the field.


text: Technical Safeguards and Risk Management Processes. We have implemented a risk management framework to identify, evaluate, and address cybersecurity risks. This framework includes the deployment of tools to detect potential threats, the maintenance of detailed incident logs, and the development of risk mitigation strategies. Our cybersecurity measures and policies are subject to regular testing and continuous improvement to adapt to new threats as they arise.


text: Education and Incident Reporting. We have instituted a company-wide security awareness training program to educate employees about cybersecurity risks and their role in maintaining our security posture. Continuous education and testing support our workforce in remaining knowledgeable and vigilant to cybersecurity threats. Employees are instructed to report all cybersecurity concerns directly to our internal information technology ("IT") team for immediate assessment and response.


text: Cybersecurity Incident Response Plan. We maintain a comprehensive incident response plan designed to mitigate the impact of a cybersecurity incident. This plan includes protocols for internal response, external communication, and remediation efforts to minimize the impact on our operations and stakeholders.


text: Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We engage in the periodic assessment and testing of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a range of activities, including audits, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board receives reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Senior Director of IT and Cybersecurity, in coordination with our executive officers, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, the Company's internal IT team is deployed to work with business functions across the Company to address cybersecurity threats and to respond to cybersecurity incidents. The Senior Director of IT and Cybersecurity, as leader of the internal IT team, monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the executive officers and Board when appropriate.


text: The Senior Director of IT and Cybersecurity has served in various roles in information technology and information security for more than two decades with a track record of managing systems compliant with relevant security standards. The Senior Director of IT and Cybersecurity has industry experience and education aligned with the Company's work and the data we maintain. The Senior Director of IT and Cybersecurity's expertise is complemented by that of the Company's CEO and Interim CFO, each with degrees in their respective fields and extensive leadership experience including experience managing risks at similar companies.


text: We face a number of cybersecurity risks in connection with our business. Such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date. For more information about the cybersecurity risks we face, see the risk factor entitled " Security breaches, loss of data, and other disruptions to our business or the business of our third-party service providers could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and reputation. " in Item 1A. Risk Factors.


text: The Company's cybersecurity risk management program is integrated into our enterprise risk management program and is designed to expeditiously identify, analyze and protect against security threats to its computer systems, software, networks, storage devices and other technology assets. Our management team, with input from our Board of Directors, proactively manages the Company's cybersecurity risks to avoid or minimize the impacts of attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt service, sabotage systems or cause other damage. Specifically, the Company has appointed a Chief Information Officer ("CIO") to maintain a comprehensive information security program. Our strategy includes a continuous improvement mindset along with a defense in depth approach to cybersecurity. Our layered security architecture consists of innovative technology to detect, prevent, and mitigate cybersecurity threats. Ongoing proactive analysis of cyber threat intelligence ensures that we are taking the appropriate counter measures to defend against the latest threats. We use monitoring and preventive controls to detect and respond swiftly to data breaches and cyber threats involving our systems. We regularly evaluate our systems and controls and implement upgrades as necessary. This includes regular consultation with external cybersecurity experts. In addition, we participate in external tabletop exercises on a regular basis in addition to conducting our own internal tests of our systems. We also attempt to reduce our exposure to our vendors' data privacy and cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions. The additional cost to us of data and cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third-party technology providers, consulting and testing firms, insurance premium costs, legal fees and the cost of personnel who focus a substantial portion of their responsibilities on data security and cybersecurity.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. Further information regarding cybersecurity risks can be found in Item 1A. Risk Factors, of this Annual Report on Form 10-K.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: Cybersecurity Risk Management and Strategy We consider the protection of our customers' and corporate data to be a priority within our business. We continually monitor and assess the cybersecurity landscape and invest in enhancing our cybersecurity capabilities and strengthening our partnerships with appropriate business partners, service partners, and government and law enforcement agencies to understand the range of cybersecurity risks in the operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Through these partnerships, we incorporate threat intelligence, security operations, continuous training, and penetration testing. We strive to reduce the threat landscape for both the Company and our customers, through vigilantly monitoring systems and general technology controls.


text: The Company uses an Agility Preparedness Plan ("Agility Plan"), along with incident response policies, to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Company and with our Board of Directors, notify law enforcement, regulatory bodies, and other government agencies, and notify customers and employees. The Agility Plan provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team ("CMT"). The CMT facilitates coordination across key stakeholders of the Company. The Company's CIO and key members of management are members of the CMT. The Company provides the CIO and the information security team the latest tools and techniques to protect the confidentiality, integrity and availability of the Company's data for the benefit of our customers, employees and shareholders. We regularly engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities specifically include internal audits, vulnerability assessments and penetration testing. The Company's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives. The CIO and other members of the information technology team receive ongoing training related to developing threats, proactive solutions and industry best practices in order to effectively protect the Company and its stakeholders.


text: The Company maintains a third-party risk management program designed to identify, analyze and monitor risks, including cybersecurity risks, associated with vendors and outside service providers. Our vendor risk management team collaborates closely with the information security team to ensure third parties meet certain information security control requirements. Our information security team proactively monitors our internal systems and email gateways for phishing email attacks. Remote connections are also assessed and monitored given a portion of our workforce works remotely. Personnel serve as members of both teams helping to effectively identify and communicate issues as they develop.


text: Our Board of Directors provides direction and oversight over the Company's enterprise-wide risk management program, including risks related to cybersecurity. The entire Board of Directors is provided regular updates regarding the Company's information technology policies, procedures, risks and operating status. These updates include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Cybersecurity incidents are managed through the Agility Plan, and other appropriate response policies, which provide direction to management allowing for the timely transfer of information throughout the organization. Our policy requires material incidents to be reported within 36 hours after an incident is determined to be material with the materiality determination to be completed without unreasonable delay. The CMT has developed a plan to facilitate making timely determinations as to whether and when incidents should be disclosed. If a material incident occurs, the Company will describe in detail the material aspects and nature, scope and timing of the incident, along with the impact to its financial condition and results of operations via the timely filing of Form 8-K.


text: To our knowledge, previous cybersecurity incidents have not materially affected the Company, its business strategy, financial condition or results of operation. With regard to the possible impact of future cybersecurity threats or incidents, see "Item 1A. Risk Factors."


text: We face risks associated with cybersecurity. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors - The occurrence of security breaches and cyber-attacks could negatively impact our business." and "- Privacy and data security concerns, laws, or other regulations could expose us to liability or impair our operations.."


text: The purpose of our cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of our business objectives. Under our comprehensive risk management program, the Board of Directors of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to our business, corresponding risk-mitigation efforts and day-to-day management of our risk management program. The full Board of Directors retains oversight over management's cybersecurity efforts. At least annually, and often more frequently, our Board of Directors receives cybersecurity briefings from senior executives, including, when appropriate, executives focused on cybersecurity matters.


text: Our companywide cybersecurity policy sets the framework for our approach to cybersecurity. Each business unit and our corporate headquarters designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under our approach to cybersecurity, each business unit designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. Our cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter. Our policies and procedures are also designed to oversee and identify material cybersecurity risks related to third-party vendors and service providers.


text: Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets, whether commercial products or custom solutions. Our cybersecurity program focuses on protecting and enhancing the security of our information systems, software, networks, and other assets, whether commercial products or custom solutions. These efforts are under continuous review for improvement within the changing threat landscape and are designed to protect against, and mitigate the effects of, cybersecurity incidents that could result in unauthorized access to confidential, sensitive, or personal information of associates or customers or proprietary company information and potentially disrupt or impede our operations or otherwise cause harm to the Company, our customers, suppliers, dealers, or other key stakeholders.


text: Our cybersecurity program leverages both internal and external techniques and expertise across the cybersecurity spectrum. We maintain and utilize industry best practice capabilities, processes, and other security-related measures, based upon National Institute of Standards and Technology (NIST) and Control Objectives for Information Technologies (CoBIT) frameworks. Our capabilities, processes, and other security measures include, among others: Threat detection through the use of security information and event management software; Incident management processes for any security-related activity, requiring senior management signoff; Corporate endpoint detection and response software, which monitors for malicious activities on external-facing endpoints; Cloud monitoring tools, running on primary public and private cloud environments;


text: Data encryption at rest and during transit and immutable data backups; and Business continuity, disaster recovery and incident response plans.


text: We also expect our suppliers to follow the same industry-standard security practices that we follow. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, the responsibility ultimately rests with our suppliers to establish and uphold their respective cybersecurity programs. The ability and availability of information to monitor the cybersecurity practices and controls of our suppliers is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in information systems, software, networks, and other assets owned or controlled by our suppliers. Although the Company attempts to manage its exposure to such events through the purchase of cyber liability insurance, such events are inherently unpredictable, and insurance may not be sufficient to protect the Company against all losses. There is no assurance that the Company's security systems or processes will prevent or mitigate future break-ins, tampering, security breaches or other cyber-related attacks.


text: Cybersecurity Governance Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. Our Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Innovation and Technology Committee. In connection with that oversight responsibility, our Senior Vice President of Technology and Chief Legal Officer meet with the Innovation and Technology Committee on a quarterly basis to provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape.


text: Our information security team works closely with key stakeholders, including regulators, government agencies, law enforcement, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.


text: When a cybersecurity threat or incident is identified, the Senior Vice President of Technology and the security team works closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provides information to senior management, with the goal of timely assessing such incidents, determining applicable disclosure requirements and communicating with the Chairs of the Innovation and Technology Committee and the Audit Committee, regarding any significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, associates and stakeholders, and continues to provide regular reports until such incidents are concluded. The above framework tracks and allows team members to monitor each incident throughout its lifecycle to ensure the Company is informed about and following cybersecurity incidents as they are mitigated and remediated. Post-incident reviews are also performed to determine if there are any additional controls that may feasibly be implemented to prevent recurrence.


text: Risk Management and Strategy We believe cybersecurity plays a strategic role in ensuring smooth business operations. We are committed to developing, implementing and maintaining cybersecurity measures and processes that are designed to safeguard our information systems, data and operations, and to assess, identify and manage cybersecurity threats that may impact our business.

companyName: Clearfield, Inc.

ticker: CLFD


text: We operationalize our cybersecurity program through an information security management system based on the ISO/IEC 27001:2022 standard. This does not imply that we meet any particular technical standards, specifications, or requirements - only that we use the ISO/IEC 27001:2022 standard as a guide in designing and implementing our cybersecurity program. We believe designing and building our cybersecurity program around best practices and principles helps support robust business continuity.


text: Our cybersecurity program is integrated into our overall risk management system and processes. Key elements of our cybersecurity risk management program include, among others: Ongoing cybersecurity training and testing for our employees; Regular patching, vulnerability scanning, penetration testing, and network monitoring; Robust IT infrastructure to help reduce opportunities for adverse exploitation; Operational processes that reinforce cybersecurity policies and IT controls; Regular audits to assess our cybersecurity posture, maturity, and progress;


text: A cybersecurity incident response plan operationalized in a governance, risk, and compliance ("GRC") platform; and A third-party risk management process for vendors that includes annual assessments and Service Organization Control Type 2 (SOC 2) reviews While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date we have not experienced any cybersecurity incidents that have materially affected our business strategy, financial condition, or results of operations. The cybersecurity threat landscape continues to evolve and escalate. We are subject to ongoing risks from cybersecurity threats that could materially affect our business strategy, financial condition, or results of operations, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Our Board of Directors includes cybersecurity risk as part of its overall risk oversight function, and has delegated to our Audit Committee responsibility for overseeing, reviewing and discussing with management: (i) our cybersecurity, information technology and data security risks and threats; (ii) the potential impact of those risks and threats on our business, operations, and reputation; and (iii) management's processes, procedures and actions to identify, assess, monitor, mitigate, and remediate such risks and threats. Management provides the Board and the Audit Committee regular reports and assessments on our cybersecurity program and material cybersecurity risks. In addition, management updates the Board and the Audit Committee, as appropriate, regarding significant cybersecurity incidents should they occur.


text: A cybersecurity incidence response team comprised of key function heads and personnel, including IT, Finance, Legal, and Human Resources, provides operational support for clarifying and acting on cybersecurity issues, including decision-making around materiality, escalation and disclosure. Our cybersecurity program is principally managed by our Chief Information Officer and our Information Security Manager. Together, they have over 50 years of experience in IT, including developing, implementing, and operating IT controls. Our Chief Information Officer and our Information Security Manager manage cybersecurity risks by continually working to reduce risks, respond appropriately to incidents, and invest in hardening our attack surface to improve our cybersecurity posture. Our GRC platform is designed to provide reliability in identifying, tracking, and mitigating cybersecurity risks. We also engage third party assessors, consultants, and auditors to extend internal team capabilities and support our cybersecurity program, including engaging a cybersecurity service provider that provides 24/7 continuous managed detection and response services.


text: As of the date of this Annual Report, we believe that we have limited risks associated with a breach in cybersecurity. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (of which we are not aware of any), have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: We have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks.


text: However, if exposed to such a risk, we would assess any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.


text: While we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems.


text: Primary responsibility for assessing any cybersecurity risks rests with our management, who would report any threat to our board of directors.


text: To date, we have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition.


text: Risk Management and Strategy In the ordinary course of our business, we, and third parties upon which we rely, collect, use, store and transmit confidential, sensitive, proprietary, personal and protected health information. The secure maintenance of this information is important to our operations and business strategy. To this end, we have implemented various cybersecurity plans and processes designed to manage cybersecurity risks relating to our third party hosted services, communications systems, hardware and software, and our critical data, including data related to our clinical trials and investigational products.

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: One of our strategies to mitigate cybersecurity risks is to utilize expert third-party software-as-a-service, human resource, and clinical providers to store and manage personally identifiable information, rather than maintaining and processing such data within our enterprise. We select reliable, reputable service providers that maintain cybersecurity programs of their own and other measures to comply with privacy and security requirements, including when applicable Canada's Personal Information Protection and Electronic Document Act (PIPEDA) and the U.S. Health Insurance Portability and Accountability Act (HIPAA). Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, we may also contractually impose certain security obligations on the provider.


text: Our executive leadership exerts operational oversight of our cybersecurity as part of our overall risk management function. We engage an expert IT and security provider to assist us with managing security risk and responding to cybersecurity threats or incidents. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and utilize back-up and recovery systems where appropriate. We also use other technology-based tools that are designed to mitigate and detect cybersecurity risks. In addition, we provide our employees with cybersecurity training, including topics such as phishing, password protection and reporting cyber incidents.


text: Our board of directors oversees our risk management strategy with respect to cybersecurity threats. The board, through its audit committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our executive leadership and security provider, concerning our cybersecurity risk management activities, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. Management also notifies the audit committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as appropriate.


text: Material Effects of Cybersecurity Incidents As of the date of this report, we have not identified any cybersecurity event or risks from cybersecurity threats that, individually or in the aggregate, would materially affect us. Notwithstanding, we, or third parties upon which we relay, may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us or our business strategy, results of operations or financial condition. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology, including, without limitation, the risk factor under the heading " We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively "


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented and maintain a security risk management program that is designed to preserve the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and our vendors have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the section titled "Risk Factors — Risks Related to Information Technology and Data Privacy".


text: Risk Management and Strategy We have implemented internal controls including regular risk assessments designed to address financial, operational and information technology (including cybersecurity) risks and controls across our organization. These assessments are overseen by our Director of IT and Chief Accounting Officer. We implement cybersecurity controls and procedures designed to address cyber risks and threats, supported by third-party technologies and security advisors and providers. We also provide cybersecurity awareness training to our employees during the onboarding process and periodically thereafter. In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments, and to evaluate our overarching information security program and specific incident response procedures. We also maintain a Cyber Incident Response Plan, which is overseen by our Director of IT and is designed to coordinate our response to information security incidents. Finally, we hold and maintain third-party insurance coverage for cybersecurity risks commensurate with industry standards for a company of our size and stage.


text: Cybersecurity Oversight The Director of IT is responsible for implementing and maintaining the information security program. The Director of IT role is currently held by an individual who has more than 20 years of professional IT management experience and maintains a Global Information Assurance Certification. The Director of IT reports to our Chief Accounting Officer, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our Chief Accounting Officer meets with the audit committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of the risk remediation and ongoing implementation of cybersecurity improvements across our organization. We also engage an external auditing firm with information security expertise to conduct regular auditing, testing, and review of our information technology risks, processes, and operations.


text: Management also generally provides quarterly updates to the audit committee on cybersecurity and other information technology risks. We have implemented a process for the Director of IT and the Chief Accounting Officer to receive incident reports and report quarterly (and, if applicable, in the event of a cybersecurity incident), to our internal disclosure committee and the audit committee, as appropriate. Management presents to the entire board of directors on an annual basis, including any key findings identified in our cybersecurity assessments.


text: The Company has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; and an incident response program documenting cybersecurity incident response and notification procedures. The Company's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Information Security Review Committee (ISRC) and the Information Systems Steering Committee (ISSC). The ISRC approves policies, procedures, and standards for information security. It also discusses IT statistics and performance relative to information security performance standards. It reports to the ISSC. The ISSC is responsible for the Company's strategic IT plan, including information security. It reviews the adequacy and allocation of IT resources and monitors major projects and overall IT performance. The strategic plan is presented to the Board annually. The ISO has several years of professional experience in cybersecurity and vendor management, and holds multiple relevant professional certifications. The ISO provides an update to the Board of Directors on a quarterly basis. The Information Security Program is approved by the Board annually.


text: The ISO maintains risk assessments for key IT systems. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are also used annually to assess cybersecurity risk.


text: Third parties are assessed and categorized according to service type, compliance risk, financial risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on inherent risk as well as specifics such as if the vendor hosts data in the cloud or has access to consumer information.


text: The Company uses a training system to educate new and existing employees on cybersecurity risks. In addition to this training program, simulated phishing attempts and remote social engineering attacks are performed on a regular basis to evaluate employees' understanding of these risks.


text: The Company uses data loss prevention, email filtering and web filtering software to ensure malicious data does not enter the Company's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. All Company networks are secured behind firewalls. Additionally, Security Information and Event Management (SIEM) technology, an Intrusion Detection System (IDS), and an Intrusion Prevention System (IPS) are used.


text: Access to data on the Company's networks is granted only if needed for job functions. Data Security Analysts review changes to access to ensure they are authorized and appropriate.


text: An Incident Response Committee that includes representatives from key areas of the Company meets in the event of cybersecurity incidents. The Committee ensures the proper notifications are made in order to comply with all relevant laws, rules and regulations.


text: During the year ended December 31, 2024, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Company. For discussion of the risks from cybersecurity threats, including potential impact to the Company's business strategy, results of operations, and financial condition, refer to "Item 1A – Risk Factors – The Company's information systems may experience an interruption or breach in security" in this Report, which is incorporated by reference in this paragraph.


text: Risk management and strategy The Company employs a multi-faceted approach to assess, identify, and manage material risks from cybersecurity threats. Components of our approach include the following:


text: The Company aligns its cybersecurity program with the Center for Internet Security ("CIS") framework of Critical Security Controls System penetration testing is performed by rotating third-party service providers at least every 18 months.


text: System vulnerability testing performed by our cybersecurity partner who is System of Organization Controls ("SOC") 2 certified and also assists with mitigation. Network assessments are performed at least annually by qualified third-party service providers. Facilitated incident response tabletop exercises conducted at least bi-annually by qualified cybersecurity service providers.


text: Monitoring of Federal government alerts (CISA, FBI) and industry threat information is performed to stay current on the newest cybersecurity threats bad actor tactics.


text: The cybersecurity risk assessment process is part of the Company's overall risk management process. Our cybersecurity partner helps us prioritize actions to improve compliance with CIS Critical Security Controls and assists with those actions. The Company also utilizes other third-party consultants and services in our process of assessing and managing cybersecurity risk for a diverse perspective of our cybersecurity practices and posture. To mitigate the risk of cybersecurity threats related to the use of third-party service providers, the Company obtains and reviews SOC reports from third parties when available, to provide assurance that the third-party has appropriate controls in place and has not identified any significant cyber issues. The Company does not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. See Item 1A "Risk Factors" for a summary of certain cybersecurity risks.


text: General risk assessment and management oversight resides with the Company's Board of Directors. The Company's Audit Committee has oversight of financial risks and is in charge of reviewing the Company's information security disclosures and incident reporting related to cybersecurity. The Company's Board of Directors reviews the Company's information security procedures and evaluates management's assessment of materiality for cyber incidents. The Board of Directors is formally updated on cybersecurity risks no less than annually. Management is responsible for assessing and managing material risks from cybersecurity threats. This responsibility primarily resides with the VP of Information Technology and his qualified team, including dedicated cyber security personnel. The qualifications of the Information Technology team include a combination of formal education (e.g. Master's degrees in Cybersecurity and Information Assurance); CISSP and ISSMP certifications and, over 100 years of combined Information Technology experience. Management's process for monitoring prevention, detection, mitigation, and remediation of cybersecurity incidents is summarized above in the Risk management and strategy section.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the Information Technology Steering Committee and our Board of Directors.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institution Examination Council ("FFIEC") Cybersecurity Assessment Tool, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Information and Operations Officer, along with key members of his team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The Information Security Program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions and maturing our Information Security Program.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of tools and processes to identify, protect against, detect, respond, recover from, and govern the cybersecurity risks and threats. We have tools configured to block, prevent, detect, and monitor for suspicious activity providing real time monitoring and alerts for anomalous and nefarious activity, as well as advanced persistent threats. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with third parties, external service providers and our supply chain. We also actively monitor our email traffic for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer. Key members of management are embedded into the Incident Response Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Technical Safeguards and Risk Management Processes. We have implemented a risk management framework to identify, evaluate, and address cybersecurity risks. This framework includes the deployment of tools to detect potential threats, the maintenance of detailed incident logs, and the development of risk mitigation strategies. Our cybersecurity measures and policies are subject to regular testing and continuous improvement to adapt to new threats as they arise.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Our Information Systems May Experience Failure, Interruption or Breach In Security" in Item 1A. Risk Factors.


text: Our Information Security Officer is accountable for overseeing and directing our Information Security Program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has over 20 years of information security experience in the Banking, Government, Military, Energy, and Insurance sectors and has the following cybersecurity certifications: Certified Information Systems Security Professional (CISSP), BS in Information Systems with a focus in Cyber Security, CompTIA Security+, CCNA (Security), CCNA (Route/Switch), CCNA (Collaboration), CompTIA Net+, Microsoft Certified System Engineer MCSE (win2000).


text: Our Board of Directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees generally meet monthly and quarterly, respectively, to provide oversight of our risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer informs the Information Technology Steering Committee by reporting on key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken in response. The Information Technology Steering Committee meets on a monthly basis (or more frequently as may be required by the Incident Response Plan).


text: The Information Technology Steering Committee is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Information and Operations Officer provide regular reports to the Information Technology Steering Committee and our Board of Directors regarding the Information Security Program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee and our Board of Directors review and approve our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full Board of Directors at each board meeting. The principal individuals on the Information Technology Steering Committee responsible for the foregoing activities are the Chief Information and Operations Officer (Chairman of the Committee); the Information Security Officer; and the Chief Risk Officer. The experience of Chief Information and Operations Officer; Information Security Officer; and Chief Risk Officer are as follows: 35 years of experience in bank operations, systems development, payments, and information technology in Financial Services sector; 20 years of information security experience in the Banking, Government, Military, Energy, and Insurance sectors; and 29 years of experience in audit and risk management in the Financial Services Sector (banking) as an FDIC Examiner; Internal Audit Director; and Chief Risk Officer, respectively.


text: Cyber Risk Management and Strategy We rely on information technology and data to operate our business and develop, market, and deliver our products to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, manufacturing equipment and processes, lab equipment, software, and our critical data including confidential, personal, proprietary, financial and sensitive data. Accordingly, we maintain certain risk assessment processes intended to identify risks from cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business.


text: We use a layered approach designed to mitigate the constantly evolving risks from cybersecurity threats by investing in people, processes, and cybersecurity technologies. Our approach is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the Center for Internet Security ("CIS") critical security controls.


text: Our cybersecurity risk management program leverages trusted technology partners and solutions in an effort to identify and track key cybersecurity risks. This program includes period security assessments conducted in collaboration with our key stakeholders, penetration testing and vulnerability assessments, and a mandatory cybersecurity training program for employees. To manage cybersecurity incidents, our global security operations team maintains a cybersecurity incident response plan, conducts readiness exercises, and takes steps to improve the program, as appropriate, to manage the changing threats faced in our industry.


text: Education and Incident Reporting. We have instituted a company-wide security awareness training program to educate employees about cybersecurity risks and their role in maintaining our security posture. Continuous education and testing support our workforce in remaining knowledgeable and vigilant to cybersecurity threats. Employees are instructed to report all cybersecurity concerns directly to our internal information technology ("IT") team for immediate assessment and response.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third -party vendors. We apply mitigations and processes based on our evaluation of the criticality of the vendor and the sensitivity of the data the vendor accesses. Our current vendor evaluation procedures include, as appropriate, an assessment prior to onboarding and implementation of cybersecurity-specific contract provisions. We are in the process of expanding and maturing these vendor risk management procedures.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Risks from cybersecurity threats have, to date, not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition; however, from time to time, we have experienced threats and security incidents relating to our and our third party vendors' information systems. For additional information, please see the section captioned "Part I. Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Vice President of Information Technology ("VP of IT") is responsible for the direction of our information technology organization. Our VP of IT has over twenty-five years of cybersecurity and incident management experience. Our VP of IT is supported by a third-party virtual chief information security officer ("vCISO") who also has over twenty-five years of cybersecurity experience. Our VP of IT, supported by our vCISO, assesses our cybersecurity risks through regular meetings with our IT team, and escalates cybersecurity matters as needed to management.


text: The role of the Board of Directors in our risk oversight process includes receiving reports from management and the chairs of Board committees on areas of material risk to our Company, including cybersecurity risks. The Board has delegated primary responsibility to the Audit Committee to review these matters. As established in the Audit Committee Charter, the Audit Committee oversees cybersecurity risks by reviewing reports, summaries and presentations on data management and security initiatives and significant existing and emerging cybersecurity risks. This includes material cybersecurity incidents, the impact to us and our stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents. Our VP of IT presents on risks from cybersecurity threats to the Audit Committee at least annually and to the full Board, as necessary.


text: We employ processes and tools for assessing, identifying, and managing material risks from cybersecurity threats. These processes and tools are intended to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our processes and tools include procedural and technical safeguards, response plans, and reviews of our policies. We employ experienced information technology personnel to deploy and oversee these safeguards and to consult with members of our senior management team, including our Chief Executive Officer and our Principal Financial Officer and Principal Accounting Officer, regarding cybersecurity matters when appropriate. Our Audit Committee is provided an opportunity during each quarterly meeting to inquire regarding material cybersecurity threats, deficiencies, and other issues in discussion with members of management. We provide all employees and consultants with cybersecurity and prevention training.

companyName: XBiotech Inc.

ticker: XBIT