text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A - Risk Factors - We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our or our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers."


text: Management's Role in Assessing and Managing Risks from Cybersecurity Threats The CISO, in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CIO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Management Committee when appropriate.

companyName: EQUITY BANCSHARES INC

ticker: EQBK

secItem: Item 1C


text: The CISO has served in various roles in information technology and information security for over 15 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in Information Networking and Telecommunications, a graduate degree in Cybersecurity, and has attained the professional certification of Certified Information Systems Security Professional. The CIO holds an undergraduate degree in Business Finance and has served in various roles in information technology for over 30 years, including serving as either the Chief Information Security Officer or Chief Information Officer of two public companies.


text: Our board of directors and management exercise oversight over our cybersecurity program, which represents an important component of our overall approach to enterprise risk management.

companyName: Alpha Teknova, Inc.

ticker: TKNO

stage1Category: Board Governance

stage1Method: majority


text: Teknova's Vice President of Information Systems and Architecture (VP of IT) manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes, and risk assessment related to information security and data protection, including data privacy and network security (our Cybersecurity Program). The VP of IT has served in various roles in information technology and information security, along with other members of the IT department, and holds relevant and applicable certifications. The VP of IT reports directly to our Chief Executive Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our board of directors, and the audit committee of our board of directors.

stage1Category: Management Role

stage1Method: unanimous


text: Our board of directors, in coordination with our audit committee, oversees our management of cybersecurity risk, with the audit committee reviewing and discussing with management matters related to our Cybersecurity Program, including as it relates to financial reporting. The board of directors and audit committee receive periodic reports about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Additionally, risks associated with the Cybersecurity Program are integrated into our enterprise risk management assessment and reported to our Board as needed. We also share the key results of third-party assessments with our board of directors and audit committee.


text: Technical Safeguards As part of our Cybersecurity Program, we deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

stage1Category: Risk Management Process


text: Our Cybersecurity Program also includes a periodic risk assessment, which is based generally on frameworks established by the National Institute of Standards and Technology (NIST).


text: Third-Party Risk Management We also maintain procedures designed to identify and mitigate cybersecurity threats related to our use of material third-party vendors. This includes reviewing the internal controls of certain third-party service providers to assess their procedures to mitigate material cybersecurity risks, among other risks.


text: Incident Response and Recovery Planning We have an information security incident response process to prevent, detect, mitigate, and remediate cybersecurity incidents and threats. This process includes controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner, with appropriate involvement by our board of directors.


text: External Assessments We obtain periodic assessments by third party experts of our vulnerability management and security controls and to assist us in identifying and mitigating security risks.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition. For information regarding cybersecurity risks that may materially affect our Company, see the risk factor titled "Our internal computer systems, or those of our suppliers, customers, or contractors, have been and may in the future be subject to cyberattacks or security breaches, which could result in a material disruption of our business or otherwise adversely affect our business, financial condition, results of operations, cash flows, and prospects." under "Risk Factors" in Part I, Item 1A. to this Annual Report on Form 10-K.


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company works with third party companies to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: The Company recognizes the importance of maintaining our technology and data systems. Our cybersecurity policies, standards, processes, and practices are integrated across our operational departments.


text: Cybersecurity Risk Management and Strategy As one of the elements of our overall risk management program, we focus on the following key areas: • Technical Safeguards: We deploy technical safeguards, including by not limited to firewalls, anti-malware functionality and access controls. • Outside Consultants: We utilize outside consultants, including contractors and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our incident prevention, response, and documentation procedures.


text: We have not encountered cybersecurity threats or experienced previously cybersecurity incidents that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Board of Directors Oversight Our Board is aware of the critical nature of managing risks associated with cybersecurity threats. Management works with our Board to establish oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board has delegated to our Audit Committee the primary responsibility for oversight of cybersecurity risks.


text: Management's Role Managing Risk Our CEO, Chief Financial Officer ("CFO"), and Information Technology Manager ("IT Manager") play a primary role in informing the Audit Committee on cybersecurity risks. Our IT Manager has seven years of experience with the Company, which includes management of cybersecurity. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reporting, if any, and learning from any cybersecurity events; • Risk mitigation efforts and insurance, and • Compliance with regulatory requirements and industry standard.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (Information Systems and Data). Our Chief Operating Officer and our General Counsel help identify, assess and manage our material risks from cybersecurity threats. Along with our Chief Operating Officer and our General Counsel, a third-party information technology strategy and risk reduction vendor helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal audits, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds and coordinating with law enforcement as appropriate about certain threats.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a vulnerability management policy; conducting risk assessments; encrypting certain of our data; maintaining network security controls; segmenting certain of our data; maintaining access and physical security controls; asset management, tracking, and disposal protocols; systems monitoring; vendor risk management processes; employee training; maintaining cybersecurity insurance; and retaining a third party information technology strategy and risk reduction vendor.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program; our Chief Operating Officer and General Counsel work with management to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business; our Chief Operating Officer and General Counsel evaluate material risks from cybersecurity threats against our overall business objectives and our Chief Operating Officer reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including outside legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, contract research organizations and contract manufacturing organizations. We have vendor management processes to identify and oversee cybersecurity risks associated with the use of our providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, these processes may include a risk assessment of the vendor, security questionnaire, security assessments, security assessment calls with the vendor's security personnel and imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems or sensitive data, or those of our third-party CROs or other contractors or consultants, or third parties with whom we work, may fail or suffer security incidents, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive data related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

stage1Category: None/Other


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our Chief Operating Officer and our General Counsel. Our Chief Operating Officer has been responsible for the oversight of our cybersecurity since he joined our company in May 2019. He has a B.A. in Computer Science. Our General Counsel has oversight of our legal department, has prior experience serving as inside and outside corporate counsel to technology and cybersecurity companies and a highly regulated cancer diagnostics company.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Operating Officer and our General Counsel. Our Chief Operating Officer and our General Counsel will work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our Chief Operating Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We are increasingly dependent upon information technology systems, infrastructure and data to operate our business. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. In the ordinary course of business, we collect, store and transmit confidential information (including but not limited to intellectual property, proprietary business information and personal information). It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: Prelude has established an Information Security Policy ("IS Policy") in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of Prelude's information and its assets. The IS Policy was prepared using relevant guidance issued and technology standards that are used across various industries. The IS policy applies to all entities who are using Prelude's equipment and resources, including but not limited to: employees, contractors, temporary workers, any third parties with access to the Prelude's resources, and cloud IT providers. Prelude's Head of Information Technology ("IT") also serves as our Information Security Officer and is primarily responsible for implementing and overseeing the IS Policy and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.


text: Board Governance and Management Prelude's Information Security Officer provides updates on information technology risks, controls and procedure, including Prelude's plans to mitigate cybersecurity risks and respond to data breaches to Prelude's executive leadership team. Our Information Security Officer has over 20 years of experience in information security and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The Chief Financial Officer and the Chief Legal Officer report to the Chair of the Audit Committee prompt and timely information regarding any significant cybersecurity incident. The significant incident will be reported to the remaining Audit Committee members, as well as ongoing updates regarding any such incident until it has been addressed. Such incidents, as warranted, will be reviewed by the Board of Directors.


text: The Board of Directors has delegated responsibility for cybersecurity risk oversight to the Audit Committee, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, and IT risks or exposures, and the Company's policies and processes with respect to risk assessment and risk management of the same; (ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks; and (iii) regularly reporting to the full Board of Directors on such matters. The Chair of the Audit Committee has expertise in risk management which includes IT and cybersecurity.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process—Our business and operations may suffer in the event that our information technology systems, or those used by our CROs or other contractors or consultants, fail or suffer security breaches."

stage1Category: Strategy Integration


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives reports from management on our cybersecurity risks, at a minimum annually and as needed. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, lead by our Executive Director, Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our Executive Director, Information Technology's experience includes 25 years of experience in managing IT environments including assessing the overall risk management program and material risks, as well as building our cybersecurity framework over the past six years.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, response plans, regular tests on our systems, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including consultants, computer security firms and risk management, peer companies, industry groups, and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber attacks, and other related breaches.

companyName: Inozyme Pharma, Inc.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Vice President of Information Technology has over 25 years of experience working with life science companies and venture capital firms in the information technology field, a certificate from HarvardX (Cybersecurity: Managing Risk), and an active membership in Health-ISAC.


text: We have also established a cross-functional Cybersecurity Steering Committee, led by our Chief Executive Officer serving as the chair and consisting of other executive-level leaders, that is responsible for providing leadership in the protection of information assets and technology. The committee members advise on and prioritize the development of information security initiatives, projects, and policies as advocates for our stakeholders. This committee is also charged with helping to resolve security and compliance risk issues affecting us.


text: In order to help deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with a monthly data protection, cybersecurity, and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. We engage third-party vendors for 24/7 monitoring and comprehensive incident response measures. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We recognize the importance of maintaining cybersecurity measures to safeguard our information systems and to protect the confidentiality and availability of information located on our information systems. Given this importance, we have integrated the consideration of operational risks related to cybersecurity into our enterprise risk management program, which is reviewed and updated annually and the results of this review are presented to the Board.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Given the size and scope of our operations, RCM and our officers use a third-party IT service provider to assist the Corporation in assessing, identifying and managing the material risks from cybersecurity threats to the Corporation and in administering our IT systems. We believe that our third-party IT service provider has sufficient knowledge, experience and capabilities to effectively assist the Corporation on cybersecurity matters.


text: The Corporation's cybersecurity risk management systems processes, which are formalized in the Corporation's cybersecurity risk management policy, include security controls, monitoring systems, tools and related services, and oversight from each of RCM, our officers and our third-party IT service provider in assessing, identifying and managing risks from cybersecurity threats. The Corporation, through our third-party IT service provider, has implemented and expects to continue to implement risk-based controls designed to prevent, detect and respond to information security threats. We rely on these controls to help us protect our information, our information systems, and the information of third parties who entrust us with their sensitive information.


text: The Corporation's cybersecurity risk management policies include physical, administrative and technical safeguards, as well as plans and procedures designed to help the Corporation seek to prevent and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or RCM. In addition, our cybersecurity risk management program includes periodic identification and testing of our vulnerabilities and cybersecurity awareness training. Finally, our Chief Compliance Officer conducts an annual due diligence review, including as to cybersecurity matters, of those third-party service providers that have possession of the Corporation's material non-public information and reports the results of those assessments to the Board.


text: Material Impact of Cybersecurity Risks In the last three fiscal years ended December 31, 2024, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors — Risks related to our Business and Structure — We are subject to cybersecurity risks and incidents that may adversely affect our operations, the operations of RCM or the companies in which we invest. A failure in our, or RCM's, cybersecurity systems could impair our ability to conduct business and damage our business relationships, compromise or corrupt our confidential information and ultimately negatively impact business, financial condition and operating results."


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by the officers of Rand and RCM, and is primarily administered by our experienced third-party IT service provider. The officers of Rand and our third-party IT service provider are in regular communications as a means to discuss and determine actions to be taken by the Corporation with respect to our ongoing cybersecurity risk mitigation efforts.


text: The Board, as a whole, rather than any committee of the Board, has responsibility for oversight and review of cybersecurity matters with respect to the Corporation, including the risks from cybersecurity threats to the Corporation. Our Chief Compliance Officer reports to the Board on a semi-annual basis, or more frequently if necessary, on cybersecurity matters and developments applicable to the Corporation. In addition, the Board also receives periodic reports from the Corporation's third-party IT service provider. These reports, whether from the Chief Compliance Officer or the Corporation's third-party IT service provider, include updates on the Corporation's cybersecurity programs, the external threat environment, and the Corporation's programs and processes to address and mitigate the risks associated with the evolving cybersecurity threat environment. In addition, these reports also include updates on the Corporation's overall IT systems and capabilities and the Corporation's business continuity plan that may need to be activated if a material cybersecurity incident involving the Corporation were to occur. In the event of a material cybersecurity incident, our Chief Compliance Officer would make a report to the Board regarding the event, and the Board would engage in oversight responsibility with respect to the Corporation's response to such event.


text: The Company understands that security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Company is focused on addressing cybersecurity risks on confidentiality, integrity, and the availability of the information the Company collects, transmits and stores by identifying, preventing, and mitigating cybersecurity risks. The Board of Directors, through the Board Risk and Audit Committees, and the Company's Enterprise Risk Management Committee provide direction and oversight of the enterprise-wide risk management program of the Company, which includes the Information Security Program. The Chief Information Officer and the Chief Risk Officer oversee these programs to accomplish the following: • assure the confidentiality, integrity and availability of our information and information systems; • protect against any anticipated threats or hazards to the confidentiality, integrity or availability of such information and information systems; and • protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our clients and the value of the Company.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: These programs establish policies (including vendor management), procedures, risk assessments, systems, monitoring, reporting, strategies, and training to effectively manage cybersecurity risks. Specifically, the Company deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. The Company also performs simulations and drills to further ensure our readiness and preparedness for potential threats. In addition, the Company employs a nationally recognized firm with information security experts to annually perform audits that extensively test our program and controls, which are reviewed by the Board Audit Committee. These programs and controls align with Federal Financial Institutions Examination Council guidelines and standards.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are present and similar to other financial institutions. The Company, as well as our customers, colleagues, regulators, service providers and other third parties, have seen an increase in information security and cybersecurity risk in recent years. We continue to assess the risks and threats in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity collaboration and capabilities.


text: Risk management and strategy Cybersecurity is a critical aspect of our operations, and our board of directors and management prioritize safeguarding our digital assets and ensuring the integrity and confidentiality of sensitive information to protect our assets, customers, and stakeholders. Our cybersecurity program is managed by our Global IT Director and overseen by our executive leadership team and board of directors. It encompasses risk management, a management framework, governance, education and training across the organization, SOC2 compliance, and an incident response protocol.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: We employ a proactive risk management strategy to identify, assess, track, and mitigate cyber security risks. Our risk assessment process involves continuous monitoring of our IT infrastructure, external vulnerability assessments, and reviews of our third-party relationships. We prioritize risks based on their potential impact on our operations and implement targeted controls and safeguards to mitigate identified threats.


text: Our Cybersecurity management framework is aligned with the Cybersecurity Framework (CSF) developed by the National Institute of Standards and Technology (NIST) and COBIT 2019. This framework provides a structured approach to managing our policies, standards, and processes, improving our cyber security posture. Additionally, we maintain SOC2 compliance, demonstrating our adherence to industry-recognized security standards and best practices.


text: Our board of directors and executive leadership team, through our Information Security Executive Charter, oversees our risk management program, of which cybersecurity represents an important component. Our Global IT Director is responsible for managing our risk management program, including our cybersecurity strategies and initiatives and the periodic review of our policies, standards, and risks. Our Global IT Director has over 25 years of experience in technology and security.


text: Our board of directors and executive leadership approves cyber security strategies, initiatives, and investments to ensure alignment with business objectives and risk tolerance.


text: In the event of a cyber security incident, we would follow an incident response protocol that includes procedures for incident tracking, escalation, containment, eradication, and recovery. As part of our incident response process, we would adhere to SEC reporting requirements related to cyber security incidents, providing timely and transparent disclosures as necessary.


text: Cybersecurity threats, and their evolving nature, pose a risk to us and our strategy, results of operations, and financial condition in the future. Our risk factors include further detail about the cybersecurity risks we face. To date, cybersecurity threats or incidents have not materially affected us or our operations. Our focus on risk management, governance, compliance, and incident response is intended to mitigate the potential harm posed by evolving cyber threats and challenges.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: Primary responsibility for our cybersecurity program rests with our Vice President of Information Technology, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of work experience at the Company and elsewhere. The Vice President of Information Technology is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Financial Officer. The Vice President of Information Technology at times attends meetings of the Board to report on any material developments and risk management practices.


text: The Vice President of Information Technology meets regularly with members of our information technology team, which includes a security architect whose responsibilities are dedicated solely to cybersecurity matters, a network engineer, and infrastructure director to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our cybersecurity team also works with our Chief Legal Officer to oversee compliance with legal, regulatory and contractual security requirements.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. We regularly conduct penetration and vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to our Audit Committee, but retains overall oversight responsibility for cybersecurity matters. The Board and Audit Committee periodically review the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board and Audit Committee receive reports from members of our team responsible for overseeing the Company's cybersecurity risk management, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee discusses with such members of our management team our information technology systems and procedures and will report to the Board on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board and Audit Committee in a timely manner.


text: We have adopted an Information Security Incident Response Policy that applies in the event of a cybersecurity threat or incident (the "ISIRP") to provide a standardized framework for responding to security incidents. The ISIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The ISIRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third party vendor on retainer to assist in such incidents.


text: As detailed elsewhere herein, we also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response and reporting plan.

companyName: BOX INC

ticker: BOX


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • teams principally responsible for managing (1) our cybersecurity risk assessment and mitigation processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response and reporting plan that includes procedures for responding to cybersecurity incidents; • a team responsible for compliance with security and regulatory standards including, but not limited to, Service Organization Controls (SOC) reporting, International Organization for Standardization (ISO) frameworks 27001/27017/27018/27701, FedRAMP, and HIPAA; • the use of external service providers, where appropriate, to audit, assess, test or otherwise assist with aspects of our security controls, and to assist with the design and implementation of our cybersecurity policies and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.


text: While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We do not believe our business strategy, results of operations or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Cybersecurity Governance One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our full Board regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our chief information security officer or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing, assessing and considering the overall risk management policies and procedures, including our cybersecurity risk management processes, and oversight of mitigation of risks from cybersecurity threats.

companyName: aTYR PHARMA INC

ticker: ATYR


text: Senior leaders of global cybersecurity, governance, risk and compliance teams are responsible for assessing and managing our material risks from cybersecurity threats. They also have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-specific expertise in SaaS technology, regulatory compliance knowledge, previous leadership roles in cybersecurity or related fields, as well as a track record of successfully implementing effective cyber risk mitigation strategies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engage d by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Gaia recognizes the critical importance of maintaining robust cybersecurity measures to protect our systems, data, and operations and to maintain the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, including the management of risks arising from cybersecurity threats. It is our policy to provide regular updates to our shareholders regarding material cybersecurity incidents and the steps taken to address them. We believe that transparency in this area is crucial to maintaining trust and confidence in our operations.

companyName: GAIA, INC

ticker: GAIA


text: We have implemented a comprehensive cybersecurity program designed to identify, assess, and mitigate potential threats and vulnerabilities, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program includes regular risk assessments, network monitoring, penetration testing and incident response protocols. We also provide regular, mandatory training to our personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Our Senior Director of Operations/IT and his team work collaboratively across the Company and with our board of directors and management to maintain our cybersecurity program and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our board of directors and management receive periodic cybersecurity updates from our Senior Director of Operations/IT, which may include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to our cybersecurity program. The Company's Senior Director of Operations/IT has served in various roles in information technology and information security at Gaia for over 18 years.


text: Our commitment to cybersecurity extends beyond our internal operations. We work closely with trusted third-party vendors and partners to ensure that they also meet our rigorous security standards. We utilize third-party cloud computing services as part of our global business operations. We also employ the use of third-party content delivery networks (CDN) to help us stream content in high volume to our members over the internet. Problems faced by Gaia or any of our third-party cloud computing or other network providers, involving technological or business-related disruptions, as well as cybersecurity threats, may have an adverse impact on the member experience.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company to date, including our business strategy, results of operations or financial condition.


text: Risk Management and Strategy We have certain processes and policies in place to assess, identify and manage material cybersecurity risks. We also periodically monitor and test our information systems for potential vulnerabilities. We use various tools designed to help identify, investigate and resolve cybersecurity incidents, and to help recover from them in a timely manner. These processes, policies and tools comprise our cybersecurity risk program, and are integrated into our overall risk management program.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: We have an Information Technology Policy that sets parameters for the use, privacy, security, retention, and disposal of our information and other assets. We also have an Incident Response Policy which sets forth the steps for assessment, containment, and disclosure of cybersecurity threats. These policies were prepared using relevant guidance and technology standards and are reviewed periodically.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity risk program and have assessed it against the National Institute of Standards and Technology ("NIST") cybersecurity framework. In addition, we consider the internal risk oversight programs of third-party service providers with whom we engage in order to help protect us from any related cybersecurity vulnerabilities.


text: Under our cybersecurity risk program, we provide all of our employees with periodic cybersecurity training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.


text: Although we are subject to cybersecurity risks, to date, none have materially affected our company, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity risk program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our company. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Our board of directors oversees our risk management process directly and through its committees. The audit committee of our board of directors has the power and responsibility to coordinate our board's oversight over our risk management procedures and to discuss with our management our policies with respect to risk assessment and risk management. Our board of directors has delegated to its audit committee oversight authority of our information security (including cybersecurity) risk management.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our management. Our Senior Director, Human Resources & Infrastructure, who together with our Chief Financial Officer and General Counsel, work in close partnership with our outside information technology and cybersecurity consulting firm, and collectively, comprise the core team members of our Rapid Response Team under our Incident Response Policy. The Rapid Response Team is made up of a broad range of participants with relevant education, skills, and experience to investigate cybersecurity threats and assess the materiality thereof to determine internal reporting to our audit committee and board of directors, as well as external reporting or disclosure requirements. Management provides at least quarterly updates to the audit committee, and in turn management and the audit committee provide periodic updates to our board of directors, regarding ongoing cybersecurity risk assessments and related activities.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. In collaboration with our external vendors specializing in cybersecurity management, we routinely assess material risks from cybersecurity threats, including any potential unauthorized access to our information systems that could result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments of planned material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we consider whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. In consideration of the size and complexity of our business, we devote significant internal and external resources to manage material risks from cybersecurity threats. We also designate specific personnel, including our Senior Director, Information Technology, to manage the risk assessment and mitigation process and to closely coordinate with our General Counsel on applicable regulatory obligations.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through required policy review and trainings at the time of hire and periodically during their employment with us.


text: We engage consultants, auditors, or other third parties in connection with our risk assessment processes. These professionals assist us in the design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. In addition, in order to mitigate cybersecurity risks associated with our use of third-party service providers, we require certain third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our computer systems, or those of any of our CROs, manufacturers, contractors, consultants or other third parties or potential future collaborators, may fail or suffer security incidents or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors (our "Board") is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: Our Senior Director, Information Technology, along with the members of our Incident Response Team, which includes our Senior Vice President, Finance and our General Counsel, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Incident Response Team is supported by an experienced managed service provider and an incident response provider with extensive global cybersecurity expertise, who each monitor, assess and report threats to us. Additionally, our Senior Director, Information Technology has over twenty years of experience operating in the information technology, security and cybersecurity space. In particular, he has experience with cybersecurity assessment and prevention, incident responses, breach notifications and remediation.


text: Our Senior Director, Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above and, along with and informed by the Information Technology organization and our Incident Response Team, monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Depending on the severity of the security incident, the Incident Response Team will report the security incident to our Audit Committee, including the financial impact of the security incident and any regulatory violations. As our Information Technology organization monitors the security and effectiveness of our policies and procedures, they also work to keep the Senior Director, Information Technology and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure.


text: Our Audit Committee receives an annual briefing regarding our company's cybersecurity risks and activities, including the status of cybersecurity system development, company-wide cybersecurity training programs, material changes to the cybersecurity system, policies or practices, any recent cybersecurity incidents and related responses, cybersecurity systems testing and engagement of third-party service providers in support of our cybersecurity system. Special meetings may also be called with the Audit Committee to brief the members on any material cybersecurity incidents and related responses thereto. After such briefings, our Audit Committee will provide an update to the Board on such reports. In addition, the Board will receive periodic updates in meeting materials or directly from our Senior Vice President, Finance on cybersecurity risks and activities.


text: Cyber Risk Management and Strategy Our manager of information technology works in conjunction with our third-party managed security service provider to establish and maintain our cybersecurity risk management processes, which are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework. We also leverage our managed security services provider and other third-party consultants, providers, and technologies to support our internal information technology resources to monitor, identify, and address cybersecurity risks, including managing our monitoring and alerting tools and conducting periodic assessments of certain system applications.

companyName: MYOMO, INC.

ticker: MYO


text: Further, as part of our cybersecurity risk management, we have adopted an incident response plan that has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.


text: We conduct periodic risk assessments of our information technology systems as part of our cybersecurity risk management processes and to evaluate the effectiveness of applicable security controls. Our efforts to address cybersecurity risks also include training employees, both from programs provided by our third-party managed security service provider and internal policies and training, which are designed to increase awareness of cybersecurity threats.


text: We have a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through review of applicable certifications and security reports, where available, and contractual requirements, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information please see the section entitled "Risks Related to Cybersecurity and Data Protection" in Item 1A- Risk Factors.


text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Chief Financial Officer, in consultation with internal information technology resources, other members of senior management and our third-party security managed service provider. The Chief Financial Officer is responsible for identifying, evaluating, and implementing risk management control and methodologies to address any identified risks, including risks from cybersecurity threats, with advice from our third-party managed security service provider as appropriate.


text: The Chief Financial Officer periodically provides reports to the technology, quality and regulatory committee of the board of directors regarding information technology and cybersecurity matters and associated risks. The technology, quality and regulatory committee is responsible for reviewing and overseeing the Company's risk management process and strategy, including risks from cybersecurity threats. The technology, quality and regulatory committee periodically reports on cybersecurity risk management to the full board of directors.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by GECM. In order to assess, identify and manage material risks from cybersecurity threats, GECM has implemented a cybersecurity program, which is focused on (i) protecting the confidentiality of business, client, fund investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Great Elm Capital Corp.

ticker: GECC


text: GECM has implemented an information security policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that it stores or processes and the maintenance of critical services and systems. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. GECM's policies and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. GECM's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: (1) cybersecurity risks associated with its physical and digital devices and infrastructure, and (2) cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. This program is based on recognized industry standards and is supported by both management and our Board. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use recognized industry standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by Great Elm's Information Technology & Security Committee ("IT Committee"), comprised of GECM's Chief Operating Officer and other members of Company management as well as its third-party IT and consultant. In order to oversee and identify risks from cybersecurity threats associated with its use of large vendors and material third parties who will have access to sensitive data or client systems and facilities, GECM requires third parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs periodic reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.


text: GECM also provides its employees with cybersecurity awareness training at onboarding and semiannually, as well as interim security reminders and alerts. GECM's third-party consultants conduct regular phishing tests and provide additional training as appropriate.


text: In May 2024, the SEC adopted amendments to Regulation S-P, which, beginning in December 2025, require investment companies and SEC-registered investment advisers to adopt written policies and procedures for incident response programs to address unauthorized access to, or use of, customer information, including providing notice to certain individuals affected by any such incident. We will need to comply with this amended rule beginning December 2025. With the SEC particularly focused on cybersecurity, we expect increased scrutiny of our and GECM's policies and systems designed to manage cybersecurity risks and related disclosures.


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by the IT Committee. The members of the IT Committee collectively have years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers. The IT Committee is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by the IT Committee, with support from third-party consultants. The IT Committee alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing their severity and determining potential responses, as well as communicating with business leaders and senior management and the Board of Directors, as appropriate.


text: Our Board monitors cybersecurity risk as part of GECM's overall risk management program. Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have not occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; customer attrition; and reputational risks. We have implemented several cybersecurity processes, technologies and controls to aid in our efforts to assess, identify and manage such material risks.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Risk Management and Strategy Our cybersecurity risk assessment process helps identify our cybersecurity threat risks by assessing our cybersecurity program against industry and best practices standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and the Center for Internet Security ("CIS"), as well as by annually engaging experts to attempt to infiltrate/test our information systems (as such term is defined in Item 106(a) of Regulation S-K).


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our senior leadership and executive team on a monthly basis. At the management level, we have established an information security risk committee, chaired by our Chief Information Security Officer ("CISO") and comprised of employees and executive management, to, among other things, coordinate and communicate the direction, current state, security risks (gaps) and governance of our information security program. Our cybersecurity program focuses in particular on the following key areas: Collaboration


text: To identify and assess material risks from cybersecurity threats, our Cybersecurity Governance, Risk and Compliance ("GRC") team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter experts, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: We employ a range of tools and services including (but not limited to) regular network and endpoint monitoring, vulnerability assessments and penetration testing to inform our professionals' risk identification and assessment.


text: Technical Safeguards We regularly assess and deploy internal and third party technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and board of directors on our response to a cybersecurity incident. We also have relationships with third party experts that can be utilized in the case of an incident.


text: Third-Party Risk Management Our cybersecurity risk processes address risks associated with our use of third-party service providers, including subcontractors used by those third-parties. Third-party risks are included within our GRC and procurement program, including the selection and oversight of our third-party service providers.

stage1Category: Third-Party Risk


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly train employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also have annual specialized training of our development staff that focuses on secure development best practices.


text: External Assessments We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures for handling and control of sensitive data and systems in an effort to identify areas for continued focus, improvement and/or compliance under various applicable regulatory frameworks (e.g., SOC, SOX, PCI, HIPAA).


text: Additionally, we require each third-party service provider with access to our internal systems, applications or data to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our practice is to perform due diligence, including the completion of security questionnaires and risk assessments, as appropriate, on these third parties.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Board's Oversight Role Cybersecurity is an important part of our risk management processes and an area of continued focus for our board of directors, audit committee and management. Our board of directors is responsible for the oversight of the overall corporate approach to cybersecurity risks. The board of directors has delegated such enterprise and cybersecurity risk management to its audit committee. At least quarterly, the audit committee and/or board of directors receives an overview from management of our cybersecurity threat risk management and strategy, covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and any material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the audit committee and the board of directors are also encouraged to engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management programs.


text: Under its charter, the audit committee is charged with discussing our major financial, information technology and cybersecurity risk exposures and the steps management has taken to monitor and control such exposures as well as the oversight of management's plans to address such risks. One member of our audit committee and board of directors has a strong background in information technology and cybersecurity risk management through service in related senior executive positions of other publicly traded companies meets regularly with our CISO to discuss our cybersecurity risk management processes.


text: Management's Role Our cybersecurity program, which is discussed in greater detail under the "Risk Management and Strategy" heading above, is led by our CISO, who has over 20 years of prior work experience in various roles with large public companies involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. In addition, our CISO manages a team of highly trained and experienced cybersecurity professionals in support of the cybersecurity program.


text: Disclosure Controls and Procedures In addition to the information security risk committee discussed above, we maintain a disclosure committee with certain responsibilities that include among other things, the discussion of cybersecurity matters for materiality, proper internal reporting systems and incident disclosure evaluation. The disclosure committee also has a cybersecurity subcommittee that meets at least quarterly to discuss ongoing internal and external cyber-events, as well as mapping out the response process in the event of a cybersecurity incident that may reasonably be viewed as potentially material, including assessing the incident, materiality and disclosure obligations.


text: Cybersecurity Risks In 2024, we did not identify any cybersecurity threats that resulted in a material adverse effect on our business strategy, results of operations, or financial condition. Notwithstanding the discussion above and our efforts to address cybersecurity risks, we cannot guarantee that we can mitigate or eliminate all cyber-related risks, including those related to operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; customer attrition; and reputational risks. We urge you to read our discussion regarding whether and how risks from identified cybersecurity threats could materially affect us as part of our risk factor disclosures at "Item 1A - Risk Factors"—Risks Related to Our Business and Industry" and "—Risks Related to Our Technology and Intellectual Property" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Risk Management and Strategy Standard BioTools regularly assesses risks from cybersecurity threats; monitors our information systems for potential vulnerabilities; and tests those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to protect against cyber security incidents, as well as to identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks (NIST, ISO) and include a review of our information security controls, policies and procedures to assess cybersecurity maturity against industry standards. In accordance with our IT Risk Management Program, we actively identify and assess risks based on the probability and potential impact to key business systems and processes. All risks identified are assessed to identify the range of possible outcomes and risks are prioritized by their level of importance. Each risk is assigned to a risk owner who will track, monitor, and report on the status with a risk response aligned to the probability and impact of occurrence. Risks that are considered high are incorporated into our corporate risk management program overseen by the Audit Committee of our Board of Directors (the "Audit Committee") and our Board of Directors.


text: All employees receive cybersecurity training upon hire with at least annual training thereafter with job-specific topic considerations. Our Information Security team, consisting of the VP of Information Technology, Sr. Manager of Network Security and IT Security Manager, among others, engage third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring for cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems through testing and threat intelligence awareness. The employees within our Information Security team and broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in our risk factor titled "Security incidents, loss of data, cyberattacks, and other information technology failures could disrupt our operations, damage our reputation, and adversely affect our business, operations, and financial results," in Part I, Item 1A. "Risk Factors." Refer to this risk factor for additional description of cybersecurity risks and potential related impacts on our Company.


text: As previously disclosed, in early 2019, we became aware of a ransomware attack that infiltrated and encrypted certain information technology systems, including systems containing critical business data. The financial impact of this incident was not material, and there were no changes to the previously released financial results or financial statements. As previously disclosed, immediately following the discovery, we commenced an investigation and were able to recover access to the compromised systems and restore their operation without significant loss of business data within weeks of the incident. Following the incident, we implemented additional protective measures and internal control policies and procedures. We also retained a professional cybersecurity investigation firm to conduct a full forensic analysis of the incident, and concluded that there was no evidence of malware, persistence mechanisms or other compromised exchange on-premises accounts within the Company's environment.


text: In early 2024, Standard BioTools completed a merger with SomaLogic. Critical to integration activities has been a wholesale review of policies, procedures and tools relevant to the combined cybersecurity environment with the objective of deploying and maintaining those which serve to reinforce our security presence to the greatest extent. While these activities continue, it has been noted that the SomaLogic organization takes a comparable, if not more stringent, approach to their cyber and information security posture inclusive of their ongoing ISO 27001 compliance certification.


text: While our management team is responsible for the day-to-day management of the risks Standard BioTools faces, our Board of Directors has the responsibility to oversee management's processes for identifying, monitoring, and addressing enterprise risks, evaluate and discuss with management its assessments of matters relating to enterprise risks, and oversee and monitor management's plans to address such risks. The Board of Directors takes an enterprise-wide approach to risk management designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance, and to enhance stockholder value. In order to understand the most significant risks faced by the Company and the steps being taken to manage those risks, Standard BioTools conducts quarterly enterprise risk management assessments, facilitated by the Company's executive leadership team in collaboration with the internal audit function, which are presented by management at each quarterly Board of Directors meeting. The Board of Directors' review of our business is an integral aspect of its assessment of management's tolerance for risk and its determination as to the appropriate level of risk for our Company.


text: Although the Board of Directors has determined that enterprise risk management should be the responsibility of the Board of Directors as a whole, it has delegated responsibility to oversee specific areas of risk management to its committees. Our Audit Committee oversees and reviews the Company's cybersecurity, data privacy, and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and respond to data breaches. At periodic meetings of the Board of Directors and its committees and in other meetings and discussions, management reports to the Board of Directors and its committees with respect to the most significant risks that could affect our business, including cybersecurity-related risks. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident to meet reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes are led by our Chief Financial Officer and our Vice President of Information Technology. Our Vice President of Information Technology has over 19 years of work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and has carried relevant degrees and certifications, including Certified Information Systems Auditor. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters, on an at least annual basis. Should a material breach be identified, as defined by the Board of Directors and the executive team, these management team members will notify the executive team and the Board of Directors and draft the required disclosure.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: Q32 Bio Inc.

ticker: QTTB


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We leverage the support of third-party information technology and security providers, including for periodic security testing, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors. We have also engaged a third-party with specialized expertise in cybersecurity to conduct an audit, which resulted in no notable findings, and reported the results to the Audit Committee.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team as part of the Board's continuing education on topics that impact public companies.


text: Our management team, with the assistance of the Company's third-party information technology providers, is responsible for assessing and managing our material risks from cybersecurity threats. Internal personnel, including our Senior Vice President, Finance, have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our senior management do not have direct cybersecurity expertise obtained through certifications, but their experience managing the Company, which includes consulting and coordinating as necessary with third-party information technology and cybersecurity experts, enables them to assess and manage material risks from cybersecurity threats.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our IT environment.


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management processes, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity processes, which are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), are supported by a third-party Managed Service Provider ("MSP") that assists us in managing our information technology systems.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: We implement a multi-layered approach to cybersecurity that includes, but is not limited to, employee security awareness training, phishing simulations, incident response planning, and various cybersecurity tools and technologies. We leverage the support of third-party information technology and security providers to manage our information technology systems, including through the performance of system scans and threat intelligence analysis. We have also previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we are adapting our cyber risk strategy in an effort to mitigate emerging cybersecurity risks.


text: We maintain a risk-based process to assess and review the cybersecurity practices of our third-party vendors, as appropriate, based on the level of access which the vendor has to critical operations, our information technology systems, and personally identifiable information.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. Our third party vendors may also experience threats and cybersecurity incidents from time to time. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: We take cyber risk seriously as a part of modern enterprise risk management, protecting our stakeholders and assets, and building resilient processes. The modern threat landscape requires us to consider cyber risks, and make determinations regarding how to treat the risks. We evaluate cybersecurity risks alongside other business risks.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: Governance Related to Cybersecurity Risk Management is responsible for identifying, considering and assessing material risks for the business, including risks related to cybersecurity, on an ongoing basis. Our Chief Information Officer ("CIO") is responsible for our overall IT strategy and operations, including the strategic direction of our cybersecurity program, cybersecurity risk oversight and monitoring of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The individual serving as our CIO has over 10 years of experience in information security.


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our CIO provides quarterly updates to the Audit Committee regarding our cybersecurity risks and an annual enterprise risk management update, which includes updates on plans intended to enhance our overall cybersecurity posture, to the Audit Committee. The Audit Committee updates the full Board of Directors on matters relating to cybersecurity risk management as needed.