text: The Company's CTIO leads the core elements of Ulta Beauty's IT and Digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology. He has served in various roles in information technology and information security for over 30 years, including serving as the Global Chief Technology Officer of a large public company prior to joining the Company. The Vice President IT Risk Management leads our information risk management organization responsible for overseeing the Company's information security program. She has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.


text: Risk Management and Strategy Management of cybersecurity risks is a component of our overall risk management strategy. We rely on information technology, communication networks, enterprise applications, accounting and financial platforms, and related systems in the operation of its business. Our operations also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data. Our cybersecurity risk management strategy is designed to support us in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents with the intention of protecting the confidentiality, integrity, and availability of such systems and data.

companyName: Gain Therapeutics, Inc.

ticker: GANX

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: We have implemented several processes with the assistance of third parties that we engage to help us manage our overall information technology function. These include certain processes for assessing, identifying and managing cybersecurity risks and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack, as well as to secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and periodic review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and governance experts, to enhance our cybersecurity oversight and to gain valuable insights into the ever-evolving cybersecurity landscape.


text: Our use of third parties in the conduct of our business is significant (including suppliers, CROs, CDMOs, and other service providers, and a cybersecurity incident at third party could materially adversely impact us. We assess third party cybersecurity controls prior to engaging such third parties and include security and privacy addendums to our contracts where applicable. We also require that third party service providers or partners report cybersecurity incidents to us so that we can assess the impact of the incident on us.

stage1Category: Third-Party Risk


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. During the reporting period we have not experienced any material cybersecurity incidents nor any series of immaterial cybersecurity incidents that would require to be disclosed in this year end report.

stage1Category: Strategy Integration


text: Our third party service providers report to our Principal Financial Officer who is responsible for the management of the Cybersecurity program. The Principal Financial Officer on a regular basis reports to the Audit Committee.

stage1Category: Management Role

stage1Method: majority


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk, and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Cybersecurity is an important part of our risk management program for our Board and management. The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through directory-based identity-related services for operation account security, firewall policies and periodical vulnerability threat scanning for network security and email-layer and endpoint-layer protections for data integrity on systems and user devices.

companyName: FGI Industries Ltd.

ticker: FGI


text: The Company's Director of IT is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our Director of IT has over 15 years of experience in information security positions and holds Master's degree in computer information systems. We also have constituted a cross-functional Cybersecurity Committee, comprised of Chairman, CFO, Management of Business Operations and Human Resources, which meets regularly to review enterprise-wide cybersecurity matters.


text: Our Board of Directors oversees management's approach to managing cybersecurity risks. The Board of Directors is charged with overseeing the Company's risk management program, which includes cybersecurity matters. The Board of Directors routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments and policies and practices and receives updates on technology trends and regulatory developments from the Director of IT periodically.

stage1Category: Board Governance


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats, derived from COSO framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, access control, and employee training. Risks identified by the Director of IT and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The Director of IT also routinely discusses trends in cyber risks and our strategy with our Cybersecurity Committee and management on a regular basis, in addition to an annual review and discussion with the full board.


text: In addition, we endeavor to apprise employees of emerging risks and require them to undergo bi-annual security awareness trainings and supplemental trainings as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Technology Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the President and, as discussed below, periodically to our board of directors.

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our system or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence fees to facilitate and promote program effectiveness. Our Information Technology Officer and Information Security Officer, who report directly to our board of directors, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and reliance tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using third-party cybersecurity experts. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the board of directors. The Incident Response Plan is coordinated through the Information Technology Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company.


text: Our Information Technology Officer is accountable for managing our enterprise information security function and delivering our information security program. The responsibilities of this position include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors. The function, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals responsible, including third-party vendors, are generally subject to professional education and certification requirements.


text: Our board of directors has approved management committees including the Information Technology Committee, which focuses on technology impact, and its business impact. This committee provides oversight and governance of the technology program and the information security program. This committee is chaired by the Information Technology Officer and includes the Information Security Officer and the Chief Operations Officer. This committee generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Technology Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Technology Officer Information Security Officer provide quarterly reports to the board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the board of directors reviews our cybersecurity risk profile on a quarterly basis.


text: Orchestra BioMed, ("Orchestra" or "Company") maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, in conjunction with the Company's enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology environment including systems, hardware, software, data, people, and processes.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: Cybersecurity Risk Management The underlying processes and controls of cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Orchestra has an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: Cybersecurity threats are just one of the many risks that we face. While we have not experienced a cyber-security incident, there is no assurance that we will not be impacted in the future. In 2023, risks from cybersecurity threats did not materially affect and were not reasonably likely to materially affect Ampio except to the extent that our management of risks from cybersecurity threats was reflected in our overall operations strategy in 2023. Like many of the specialized or highly technical functions within our company, we believe we obtained a greater depth of support and relevant expertise from third-party IT and cybersecurity resources at an overall lower cost profile than hiring our own employees.

companyName: Ampio Pharmaceuticals, Inc.

ticker: AMPE


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect the company, see the risk factor titled "Our business could be adversely affected by cyber threats or other interruptions to information technology, communications networks and operations." in Item 1A of this Annual Report on Form 10-K.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO

stage1Category: None/Other


text: In addition, Orchestra maintains policies over areas such as information security, IT change and configuration management, acceptable use, access on/offboarding, and data backup and recovery to help govern the processes put in place by management designed to protect Orchestra's IT assets, data, and services from threats and vulnerabilities. Orchestra partners with industry recognized cybersecurity providers leveraging third-party technology and expertise. Cybersecurity partners to the Company, including consultants and other third-party service providers, are a key part of Orchestra's cybersecurity risk management strategy and infrastructure and provide services including maintenance of an IT assets inventory, periodic vulnerability testing, identity access management controls, including restricted access of privileged accounts, physical security measures at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and traffic monitoring and automated alerting, ongoing cybersecurity user awareness training, remote monitoring and management, capacity management, industry-standard encryption protocols, formalized processes over asset and data destruction, formalized change management processes, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, and assessment. In the event of an incident, the Cyber Risk Committee would be notified and appropriate action would be taken to resolve the incident, including notifying senior management and, as appropriate, the Board.


text: Orchestra has implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes assessment of vendors during the selection/onboarding process, internal controls and security standards of vendors, compliance with service level agreements, review of SOC 1 reports on an annual basis and a regular review of vendor contracts.


text: Orchestra's Cyber Risk Committee, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of Orchestra's cyber risk management program, and for informing senior management, the Board, and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes via selection of strategic third-party partners (such as the Company's virtual Chief Information Security Officer), and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Orchestra for strategic cyber risk management, advisory and decision making.


text: The Audit Committee of the Board of Directors oversees Orchestra's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Members of the Cyber Risk Committee brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of Orchestra's cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes reporting cybersecurity incidents and updates on Orchestra's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by Orchestra's Board of Directors, at least annually, as part of the Company's corporate risk oversight processes.


text: Orchestra faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Orchestra acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Orchestra's business, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the Company's service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See "Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations" in Item 1A (Risk Factors) for more information on cybersecurity risks.


text: In July 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.


text: Given our current environment and structure of the Company, we outsourced a majority of our information technology functions in 2023, including but not limited to hosting and security access and cybersecurity generally, to third-party service providers. We relied primarily on third parties to assess, identify and manage material risks from cybersecurity threats. Our agreements with these third parties obligated these parties to provide us with various notifications and reports that help our management oversee and identify material risks from cybersecurity threats associated with our use of these third-party service providers.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Under the charter of our Audit Committee, the Audit Committee oversees management's development and implementation of policies with respect to risk assessment and risk management, which includes risks associated with cybersecurity threats. In 2023, the Audit Committee also discussed with management the Company's significant financial risk exposures and the actions management had taken to limit, monitor, control or mitigate such exposures. Our executive officers are responsible for managing risks from cybersecurity threats, which was primarily performed in 2023 by overseeing third parties involved in the management and monitoring of IT systems. Our executive officers also received reporting and information from third parties in 2023. Our management regularly reported to the Audit Committee on these risks. The Audit Committee also received reports from our legal counsel and internal auditors on cybersecurity matters. Currently, the Audit Committee also comprises the entire Board so we believe there is direct visibility by the Board to cybersecurity risk management.


text: Cybersecurity Risk Management and Strategy Our information technology ("IT") and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to customers and maintain stakeholder trust. Our Vice President of Information Technology ("VP IT") is responsible for establishing, implementing, and executing our cybersecurity program and strategy. Our VP IT has more than 25 years of IT, IT audit, and cybersecurity experience, and is involved in assessing the latest developments in cybersecurity, including potential threats and innovative risk management techniques. All IT staff are obliged to include cybersecurity as part of their everyday considerations and tasks.


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.


text: Our IT department proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: A formal enterprise-wide cybersecurity policy and related standards; Cybersecurity training and employee phishing simulations; Ongoing vulnerability assessment, identification, and remediation; Cyber incident response, IT disaster recovery, and business continuity plans; Identity and access management controls; Automated patch management and security updates; Network isolation of key operations environments; and Email filtering with attachment inspection and targeted threat protection.


text: The standards set in our cybersecurity program include the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. These standards are guided, in part, by the relevant National Institute of Standards and Technology (NIST) and American Water Works Association (AWWA) frameworks and guidance. We use various tools, security measures and technologies to aid in seeking to protect our network perimeter and internal systems from unauthorized access, intrusion, or disruption. Assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities.


text: We have policies and procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including monitoring compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants and related communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. In addition, a monitoring and detection system has been implemented to help identify cybersecurity threats and incidents. Our cybersecurity program also focuses on providing training and awareness to our employees and contractors on cybersecurity best practices.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Audit Committee receives an update from our VP IT and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our VP IT and our third-party cybersecurity consultant to review our cybersecurity strategy. In accordance with our cybersecurity incident response plan, our Board of Directors is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future.


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.. Our third-party consultant team is managed by our Chief Financial Officer who reports to the Audit Committee at the board-level, as appropriate.

companyName: SmartKem, Inc.

ticker: SMTK


text: As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: The Company maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the Company's overall risk management processes, which are overseen by the Board of Directors.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: Risk Management and Strategy The Company's Enterprise Risk Management Policy assists the Board of Directors and management in clarifying their tolerance for identifying those credit, market, liquidity, operational, legal, compliance, strategic, reputation and security (information and physical) risks that have the potential to cause material financial harm to the institution, as well as describing a methodology for determining the proper level of controls to manage and mitigate those risks. Cybersecurity is a critical component of risk management, given the increasing reliance on technology and the increasing cybersecurity threat landscape. The Information Security Program is built on the Federal Financial Institutions Examination Council (FFIEC) IT Handbooks, National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Center for Internet Security (CIS) Cybersecurity Controls (CSC), and industry best practice. The Information Security Program utilizes a defense in depth strategy that leverages multiple security measures to protect Company assets and information.


text: The Board of Directors is responsible for overseeing management's development and execution of the Company's risk management process. Risk management is administered by a senior management team called the Management Enterprise Risk Committee (MERC). Periodic risk assessments are performed to identify technical and physical risks to information systems. These risk assessments identify internal and external threats that could cause a cybersecurity incident, assessing the likelihood of potential impact of those threats, and assessing the measures and controls in place to manage the risks. As per FFIEC guidance, a Change Management Policy and Committee are in place to manage changes to technology and systems. Information Security is a member of this Committee to evaluate changes for information security impact.


text: The Company leverages internal and external auditors to periodically review information technology and information security policy, processes, and controls to ensure they meet regulatory compliance and operate effectively. Independent penetration testing is performed annually.


text: The Company maintains an Incident Response Plan and a Crisis Communication Plan that provide documented guidelines for handling potential threats and taking appropriate measures including timely notification of cybersecurity threats and incidents to senior management and the Board of Directors when appropriate. The Incident Response Plan is managed by the Chief Information Security Officer (CISO) and is reviewed and tested at least annually. The Crisis Communication Plan, managed by the Director of Marketing and Alternative Delivery, is reviewed and tested at least annually.


text: The Company uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing and vulnerability assessment. The Management Enterprise Risk Committee has established risk management guidelines for third-party vendors. Through the Vendor Management Committee, the Company conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, the Company's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed periodically. The Company cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, the Company may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that the Company shares with such providers.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, the Company has not detected any material cybersecurity incident to our own systems. However, during the second quarter of 2023, a prominent third-party vendor experienced a cybersecurity incident due to a previously unknown (i.e., zero-day) vulnerability in a popular file sharing software the vendor used called MOVEit Transfer. For further information regarding this incident, please see our Quarterly Report on Form 10-Q for the quarter ended June 30, 2023 filed on August 10, 2023 and our Quarterly Report on Form 10-Q for the quarter ended September 30, 2023 filed on November 9, 2023. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, or financial condition.


text: The Company's information technology resources are managed by the Information Technology Department, which is responsible for the first line of defense – identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (CIO), who reports to the Company's President and CEO. The present CIO has been employed by the Company in the information technology area for two and a half years and was previously the CISO at the Company for two years. The present CIO has over thirty-five years of IT experience, twelve of that in banking. The CIO holds a current Certified Information Systems Security Professional (CISSP) designation.


text: The Chief Information Security Officer (CISO) whose responsibilities constitute the second line of defense provides the vision, leadership, and strategies necessary to protect the information security of the Company. The CISO manages policy, procedure, and process to ensure the execution of the Company's Information Security and Business Continuity/ Disaster Recovery (BC/DR) Programs. The CISO reports directly to the Chief Risk Officer to provide segregation between the first and second line of defense. The Information Security Department, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Company's information systems, and monitors implemented security measures.


text: The Company has established a Management Technology Committee and a Board Technology Committee. These Committees provide oversight and governance of information technology and the Information Security Program and meet quarterly. The Board Technology Committee's responsibilities include: (1) monitoring the strategic deployment and usage of Information Technology throughout the Company using reports and presentations from management; (2) oversight of cybersecurity preparedness through information security reports, discussion of internal events and discussion of cybersecurity topics pertinent to the Company and the industry; (3) oversight of activities in support of the Company's business continuity/disaster recovery program to ensure optimal corporate resiliency in the unlikely event of a disaster; and (4) providing broad strategic guidance on the technology direction of the Company by, among other things, overseeing the development of the AmeriServ Strategic Technology Plan.


text: Cybersecurity Risk Management and Strategy The Company is committed to ensuring that it has processes in place to detect, mitigate, and respond to cybersecurity risks. We approach cybersecurity by implementing best practices based on known frameworks. These frameworks include highly developed security checklists that serve as a guide to addressing critical cybersecurity needs. We augment our internal controls to include industry-standard security measures that protect against unauthorized access to our systems and proprietary information. These controls consider cybersecurity risks like potential breaches, technological disruptions, regulatory non-compliance, data theft, and third-party cybersecurity threats.

companyName: Medicine Man Technologies, Inc.

ticker: SHWZ


text: The Company reviews cybersecurity risks within their risk management function, which is led by our senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Vice President of Information Technology.


text: Cybersecurity Governance Our Board, as part of our risk management function, receives periodic updates on internal controls around information technology and evaluates incidents at least once a year. Our information technology team is led by our Vice President of Information Technology who has extensive experience working with information security systems. Management is responsible for developing and maintaining cybersecurity policies and standards, monitoring ongoing compliance, and ensuring our information security is aligned with our business objectives and strategies.


text: The Company has entered into agreements with third parties for hardware, software, telecommunications, and other information technology services in connection with our operations and is exploring other third-party vendors to support our cybersecurity needs.


text: Cybersecurity Risk As of December 31, 2023, the Company is not aware of any material cybersecurity incidents that impacted the Company. However, we routinely face risks of potential incidents, whether through cyberattacks or cyber intrusions over the internet, ransomware, and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion, or other scams. Notwithstanding our risk management efforts related to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material or other adverse effect on us. See Item 1A. "Risk Factors" for a discussion of our information technology and cybersecurity risks.


text: Risk Management and Strategy The Company's Information Security Program ("Program") uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as the National Institute of Standards and Technology (NIST), Financial Services Information Sharing and Analysis Center (FS-ISAC), Federal Financial Institutions Examination Council (FFIEC), and Ransomware Self-Assessment Tool (R-SAT), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.


text: The Company's third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party's operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations include reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.


text: We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at the required new employee orientation and subsequently receive information security tips via email. Employees also receive annual security awareness training.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant.


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cyber security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts to accommodate for the ever-evolving information and cyber security threat landscape. The Information Security Officer ("ISO") regularly updates these committees on the information and cyber security risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.


text: The Chief Operating Officer (COO) along with the ISO are responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our COO and ISO have over 25 years of combined related experience. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises and incorporate external resources and advisors as needed. The Program is overseen by the Information Security Committee, Board of Directors, and Compliance Committee.


text: The Company's Board of Directors monitors the Program including policies and practices. The Company's Compliance Committee and Information Security Committee along with the company's Board of Directors oversee areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The ISO also provides periodic cybersecurity updates to the Board of Directors.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial condition, to date. Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions and our business may be adversely affected by security breaches at third-parties.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: Cybersecurity Threats As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from external experts and internal threat intelligence team. A team of dedicated privacy, safety, and security professionals oversees cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership of this team includes professionals with deep cybersecurity expertise, including our Chief Information Security Officer. Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: DarioHealth Corp.

ticker: DRIO


text: As part of our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: The Company recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks affecting the Company. The Audit Committee and senior management are actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: 22nd Century Group, Inc.

ticker: XXII


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: The ISO provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages a third-party service provider specializing in information technology, which assists with the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: The Audit Committee oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. On an annual basis, the Audit Committee discusses with Senior Management cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. As applicable, the Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Senior management, in coordination with the Company's third-party service provider specializing in information technology, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communications with the third party service provider, Senior Management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.


text: The Company recognizes the importance of cybersecurity and the potential risks posed to our business operations, financial performance, and reputation. Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company. Cybersecurity risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; denial of service attacks; malware; ransomware; phishing; social engineering; and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence ("AI") tools.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology ("NIST"), employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act ("GLBA"), the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool ("RSAT"). Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits to regularly evaluate our cybersecurity posture in conjunction with obtaining cybersecurity insurance coverage to mitigate the potential financial impact of cybersecurity incidents.


text: The Board Enterprise Risk Management ("ERM") Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls. The Chief Information Officer ("CIO") manages the IT Department and reports to the Board Risk Committee and Chief Risk Officer ("CRO") on these matters. The CIO also supervises the Information Security Officer ("ISO") who is responsible for implementing and maintaining the Company's Information Security Program. The Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. Additional cybersecurity training to the ERM Committee is provided and overseen by the CRO and CIO. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company's ERM Working Group, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company. The ERM Working Group is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank's corporate strategies, and ensuring compliance with applicable laws and regulations. The Bank's IT Steering Committee in conjunction with the Bank's PMO oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.


text: The ERM Working Group provides executive management oversight, from a risk perspective, of information systems security. As referenced above, the CIO provides information security updates to the ERM Working Group at each meeting. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the ERM Working Group. Cybersecurity metrics are reported to both management level committees and the ERM Committee and ERM Working Group on a quarterly basis.


text: The Board of Directors recognizes the importance of the FFIEC for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: We continually monitor and evaluate the evolving cybersecurity landscape and the potential impact of cybersecurity incidents on our business. We may incur additional costs to enhance our cybersecurity processes and controls, to comply with new or changing laws, regulations, or contractual obligations, or to respond to or recover from cybersecurity incidents. We may also experience reputational harm or loss of customer confidence or trust as a result of cybersecurity incidents. Any of these factors could have a material adverse effect on our business, financial condition, results of operations, and reputation.


text: Despite our efforts to enhance our cybersecurity posture, we cannot guarantee that our processes and controls will be sufficient to prevent or mitigate all cybersecurity risks and threats that we face. We may experience cybersecurity incidents that result in unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; disruption or degradation of our operations; loss of customers or business opportunities; regulatory investigations or enforcement actions; litigation or liability; reputational damage; or increased costs.


text: Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with Enterprise Risk Management, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT Steering Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. Ensuring that changes to security configurations are documented, approved, and tested. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. Investing in additional technologies or resources to aid in the evaluation, identification and mitigation of risks. Conducting subsequent penetration testing and vulnerability assessments, as warranted.


text: Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis, which may identify additional risks or require additional costs to remediate.


text: Service Providers. The Company relies, in part, on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Risk Management Program, which is implemented through a Vendor Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Vendor Relationships: Risk Management. The Vendor Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the CIO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CIO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CISO is responsible for implementing and maintaining the IRP, which includes:


text: Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.


text: Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.


text: Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures. Report up to the Executive Incident Response Committee, as needed.


text: The Bank, as part of its risk management process, has implemented an information security program that encompasses the Bank's cybersecurity efforts. The Bank's goals of confidentiality, availability and integrity of its information are key to this process and program. The Bank's goals of protecting confidential information and safeguarding our digital assets are foundational objectives of the program.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors annually approve this information security program and regularly receive a report from the Bank's Information Security Officer that outlines the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer updates the Boards of Directors through supplementary reports on issues related to Cybersecurity readiness.


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations, and these third-party vendors continue to be a source of operational and informational risk. Accordingly, the Company has implemented a third-party risk management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer. Together with the Bank's Information Technology Committee, comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security Officer of the Bank works to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors receives training annually.


text: The Bank engages trusted third parties to audit and examine its processes, review the security of its network infrastructure, and assist the Bank in designing and implementing robust cybersecurity systems. These trusted third parties help the Bank improve and test its cybersecurity readiness. The Bank engages third party vendors to monitor and test its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by specialized vendors that assist the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.


text: Although the Company and Bank have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected their business strategy, results of operations or financial condition, there can be no guarantee that the Company or Bank will not experience such an incident in the future.


text: As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation –Cybersecurity" included in Part I. Item 1 – Business of this report.


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, violation of privacy or security laws and other litigation and legal risk; and reputational risks. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future.

companyName: MetaVia Inc.

ticker: MTVA


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards. We work with a third-party provider to monitor for threats and potential cybersecurity breaches.


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or reported by our third-party monitoring service that may affect our information services, and have processes to assess those issues for potential cybersecurity impact or risk. We impose security requirements upon our suppliers and CROs, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the audit committee, which reviews our cybersecurity program with management and reports to the Board.


text: The audit committee is central to the Board' oversight of cybersecurity risks and bears the primary responsibility for this domain. The audit committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Our chief executive officer, chief financial officer and corporate controller have operational experience in assessing and managing cybersecurity risk. Our chief executive officer plays a pivotal role in informing the audit committee on cybersecurity risks. They provide comprehensive briefings to the audit committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the audit committee and chief executive officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the board's oversight is proactive and responsive. The audit committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of NeuroBo.


text: Our chief financial officer is informed by our third-party monitoring service of any cybersecurity incidents, who will then escalate the incident to our chief executive officer, if necessary. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management and Strategy Managing cybersecurity risks is an important component of our approach to enterprise risk management. As part of our overall risk management system, we have established certain procedures to assess, identify, mitigate and respond to risks from cybersecurity threats. We have regular programs to evaluate cybersecurity threats and to assess our systems, procedures and processes in order to identify areas of potential vulnerability and to improve our protection against evolving cybersecurity threats. We use a number of different methodologies in our regular assessment of cybersecurity risks with respect to our information systems, including vulnerability testing, security enhancement and evaluation of external threats, including in connection with potential data breach, ransomware and other forms of unauthorized access.

companyName: RH

ticker: RH


text: As part of our overall cybersecurity protection program, we have created a cross-functional cybersecurity team consisting of senior members of information technology, legal, accounting, internal audit and compliance teams (the "Incident Response Team") that contributes to various aspects of our approach to managing cybersecurity risks. Our senior information technology leaders who are members of the Incident Response Team have experience and domain expertise in cybersecurity, including defining and implementing security policies and tools, understanding and evaluating relevant threats to our technology infrastructure as well as developing incident response protocols and security operations workflows. We also incorporate third-party expertise in various aspects of our cybersecurity program, including in the assessment and testing of weaknesses as well as the adoption of software and other solutions to mitigate risks and identify and respond to threats. Our Incident Response Team is involved in all aspects of our program to address cybersecurity matters, including with respect to the design and management of internal controls and procedures governing these matters.


text: Our information technology team oversees the day-to-day management of our cybersecurity program with regular reporting to representatives of our Incident Response Team. Our information technology team has overall responsibility for our cybersecurity risk management program and procedures and reports regularly to the Audit Committee of our Board of Directors on cybersecurity matters. From a governance perspective, (i) we have an executive response team consisting of various senior executives, including our Chief Financial Officer, as well as members of our Incident Response Team (the "Executive Response Team") that oversees the recommendations, actions and responses of the Incident Response Team in connection with specific cybersecurity incidents, and (ii) the Audit Committee as well as our Chief Executive Officer are provided with updates from the Executive Response Team and the Incident Response Team regarding incidents as well as the policies, standards, processes and practices that we implement to address risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity matters that address a wide range of topics, including recent developments, evolving standards, vulnerability assessments and third-party reviews.


text: Incident Response We have a written information security incident response plan (the "Incident Response Plan") that we use to assist in our response to cybersecurity incidents. The Incident Response Plan provides a framework and process for our Incident Response Team. While our Incident Response Team identifies our initial response to potential or actual cybersecurity incidents, the Executive Response Team oversees the actions and recommendations of the Incident Response Team in connection with specific cybersecurity events. In addition, we have various processes to escalate matters based upon the threat level severity. The Incident Response Team and Executive Response Team (i) make ongoing assessments of the severity of incidents, (ii) escalate these matters based upon the severity of the threat level, (iii) depending on the level of severity of an incident, also involve our Chief Executive Officer or Audit Committee and Board of Directors in assessing specific cybersecurity incidents, (iv) determine the appropriate level of response to specific incidents taking into account the nature of the incident, and (v) take overall responsibility for leading and coordinating response efforts, involving additional response team participants and retaining third-party assistance, including legal counsel and other third-party cybersecurity experts, and assessing materiality of an incident.


text: We incorporate assessment of our cybersecurity risk management and strategy into our overall management of enterprise risk. The Company evaluates cybersecurity threat risk areas across its business including, but not limited to, operational risk, fraud, harm to employees or third parties, patient safety and violation of privacy or security-related laws or regulations. The Company has a Compliance Committee that is responsible for overseeing the enterprise risk management process. As part of our efforts to mitigate cybersecurity threats, we have implemented cybersecurity processes, technologies, and controls designed to effectively identify and manage potential material cybersecurity threats.

companyName: AGILE THERAPEUTICS INC


text: Threat Mitigation While we engage in numerous efforts to protect ourselves from cybersecurity risks, we do periodically experience cybersecurity incidents. To date we have not experienced any cybersecurity threat or incident that has materially affected our business, results of operations or financial condition. We have also not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Although we have adopted various processes and preventative measures with the objective of preventing breaches and minimizing the risks from cybersecurity matters, given the nature of cybersecurity threats that are constantly evolving over time, there is no guarantee that we, including our business strategy, results of operations or financial condition, will not be adversely affected by such threats or that our preventative measures and processes will be effective. Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events.


text: For further discussion of our risks related to cybersecurity, refer to Item 1A—Risk Factors—Material damage to, or interruptions in, information systems as a result of external factors, staffing shortages, cybersecurity breaches or cyber fraud, or difficulties in updating our existing software or developing or implementing new software could have a material adverse effect on our business or results of operations, and we may be exposed to risks and costs associated with protecting the integrity and security of our customers' information.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development, to communicate internally and externally, to operate our accounting and record-keeping functions, to store and access data including sensitive patient data and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Solana Co

ticker: HSDT


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or patients, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.


text: In coordination with third-party consultants, we have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct annual reviews and tests of our information security program to evaluate its effectiveness and improve our security measures and planning.


text: To operate our business, we utilize certain third-party service providers and vendors to support a variety of functions. We seek to engage reliable, reputable service providers and vendors that maintain cybersecurity programs, and we implement a vetting process to ensure that all third-party service providers and venders comply with our cybersecurity program requirements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. Oversight of such cybersecurity risks is executed directly by the Board of Directors. The Board receives reports and engages in regular discussions with management regarding the Company's significant risk exposures resulting from material cybersecurity threats and the measures implemented to monitor and reasonably manage these risks.


text: Our Director of Information Technology leads our information security organization and reports to our Chief Executive Officer and Chief Financial Officer on matters related to cybersecurity who then in turn report to the Board of Directors any material information regarding such cybersecurity matters. Our Director of Information Technology has over 30 years of IT experience and has developed a focus of experience in the healthcare industry.


text: As indicated above, supporting the operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Assessment, Identification and Risk Management of Cybersecurity Threats We employ a range of tools and services, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessment and penetration testing, to update our ongoing risk management and strategy. Furthermore, we have a cybersecurity assessment process that is conducted regularly with our current information technology (IT) services provider. -We proactively engage with our IT services provider as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We also have used an additional third-party services provider to perform internal and external penetration testing and social engineering employee challenge testing.


text: Governance and Oversight of Cybersecurity Threats Our information security program is managed by our Chief Corporate Planning and Supply Chain Officer (CCPO), who has more than ten years' experience managing IT services for Agile and possesses the required subject matter expertise, skills, and experience expected of an individual assigned to these duties. Our information security team, which includes the CCPO as well as additional professionals from our IT services provider, is responsible for leading enterprise-wide cybersecurity threat strategy, policy, standards, and processes. Our CCPO provides regular updates to our Chief Executive Officer and other members of management regarding cybersecurity threats and participates in the quarterly Compliance Committee meetings.


text: The Audit Committee is responsible for oversight of the Company's cybersecurity risk exposure. The CCPO provides reports to the Audit Committee and Board at least annually, which include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: Incident Response and Reporting The Company has a cybersecurity policy that governs the corporate response to and communication of security incidents affecting the Company's information technology system and stresses the need for fast response times and continuous improvement in security measures. The policy requires immediate reporting of any observed security incident to the CCPO, the Company's third-party IT services provider, Chief Financial Officer, and Chief Executive Officer. The CCPO, working with our IT services provider and any other third parties required, is responsible for taking steps to minimize loss and destruction, identify and correct any weakness that was exploited, restoring IT services and continuing to communicate to senior management and the Board on the event. The CCPO is authorized to employ any third-party service providers as necessary. The policy also requires the conduct of post-incident analyses, reporting on the incident, identification of lessons learned and a close-out report.


text: Oversight of Third-Party Providers Prior to doing business with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity preparedness. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.


text: Impact of Cybersecurity Threats on our Business Although risks from cybersecurity threats did not, to our knowledge, materially affect our business strategy, results of operations, or financial condition for the fiscal year ended December 31, 2023, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1, Business, in this Annual Report for a discussion of notification obligations and potential liability around data security incidents, including cyberattacks.


text: Cybersecurity Risk Management and Strategy We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats. We also engage with third parties, including consultants, to enhance our security processes.

companyName: Fortress Biotech, Inc.

ticker: FBIO


text: We have previously engaged and currently engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.


text: We review the processes of our third party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. As such, the Company engages third-party consultants and independent auditors to conduct penetration tests, cybersecurity risk assessments, external audits, and program development and enhancement where applicable.


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity".


text: Cybersecurity Governance While our board of directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.