text: Our Board oversees the Company's risk management process, including on cybersecurity risks, directly and through committees to which the Board has delegated authority. In connection with Brookfield Reinsurance's acquisition of the Company, the Company's Audit Committee was dissolved and all authority previously granted to the Company's Audit Committee was delegated to the Audit Committee of Brookfield Reinsurance. The Brookfield Reinsurance Audit Committee is responsible for overseeing our internal controls, including cybersecurity and data protection programs, and reviews the effectiveness of our financial reporting processes and internal controls, including data privacy, information technology security and control. Meetings of the Brookfield Reinsurance Audit Committee often include discussions of specific risk areas, including, among others, those relating to cybersecurity. The Brookfield Reinsurance Audit Committee also frequently discusses, in accordance with its duties and responsibilities as enumerated in its committee charter, the policies, guidelines and process by which management assesses and manages risks related to data protection and cybersecurity, including assessments of the overall threat landscape, steps management has taken to monitor or mitigate its risk exposure and related strategies and investments. Our Chief Security Officer regularly reports on data protection and information technology security matters to the Brookfield Reinsurance Audit Committee and to Argo senior management via Security Governance Council meetings.


text: As discussed above, our information security program and approach is based on the NIST Framework, and we have implemented cybersecurity policies, processes and practices designed to monitor and address cybersecurity threats and incidents. Our Chief Security Officer, in coordination with the Head of Risk, Chief Information Officer, Head of Operations, and General Counsel, is responsible for leading the assessment and management of cybersecurity risks. Our Chief Security Officer has extensive experience in information security, data protection and privacy, and regularly receives reports from our threat intelligence resources, in concert with enterprise risk, and legal departments, on cybersecurity threats and incidents.

companyName: Argo Group International Holdings, Inc.

secItem: Item 1C

stage1Category: Management Role

stage1Method: unanimous


text: In addition, plans have been authored to assist our security, legal, and finance functions in assessing and managing Argo's material risks from cybersecurity threats, and we conduct tabletop exercises and training sessions on a regular basis to help ensure effectiveness of said plans. Additionally, we also utilize outside resources to assist and participate in the determination of materiality of incidents stemming from cybersecurity threats.

stage1Category: Risk Management Process

stage1Method: majority


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K, and are integrating them into our overall risk management systems and processes by implementing and maintaining various technical, physical, and organizational safeguards, such as policies, standards, and practices relating to: • risk assessments; • incident detection and response; • vulnerability management; • internal controls within our IT, Security and other departments; • network security controls; • access controls; • physical security; • asset management; • system monitoring; • employee cybersecurity awareness and training; • phishing tests; • the use of the internet, social media, email and wireless devices; • firewalls and intrusion prevention systems; • endpoint detection and response systems; and • anti-malware functionality.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: As part of this process, we engaged external consultants who assessed our internal cybersecurity programs and alignment with applicable practices and standards, such as the Internal Control - Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission framework. We have also retained external service providers to monitor identified risk exposures, provide ongoing recommendations and software tools for their detection and mitigation, as well as evaluating the impact and coordinating the recovery from any incidents or breaches, should they occur.


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of service providers when handling and/or processing our employee, business or customer data. Further, in February 2024, we formalized our policy of monitoring third-party cybersecurity risks by requiring its consideration and approval by the IT change control board as a part of vendor selection and solution procurement.

stage1Category: Third-Party Risk


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. It receives updates on matters of cybersecurity from senior management during regular quarterly meetings and in the interim, if warranted. This includes existing and new cybersecurity risks, how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

stage1Category: Board Governance


text: Our cybersecurity risk management and strategy processes are coordinated by our Director of Technology. He maintains the Certified Information Systems Security Professional certification and has eight years of senior leadership experience in defensive cyber security in both the private sector and Department of Defense. He is supported by leaders from our Information Technology, Document Management, and Compliance teams, as well as management's Disclosure Committee who have extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. They draw on their knowledge of daily information technology operations, ongoing cybersecurity initiatives and various monitoring tools to ultimately report through the Director of Technology and Director of Internal Controls to the Audit Committee on the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents. In the event the Audit Committee determines that a cybersecurity incident has occurred, the Audit Committee will evaluate whether to escalate the cybersecurity incident to the full Board.


text: The processes described above have not indicated, as of the date of this Annual Report on Form 10-K, any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us in the year ended December 31, 2023 or are reasonably likely to materially affect our company, including its business strategy, results of operations, or financial condition.. For more information on our cybersecurity risks, see the section of this Annual Report on Form 10-K entitled "Risk Factors—We rely on our IT systems to manage numerous aspects of our business. A cyber-based attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales, and harm to our reputation."

stage1Category: Strategy Integration


text: Identifying and assessing cybersecurity risk is part of our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, IT security, governance, risk and compliance reviews, external audits and assessments, penetration tests, vulnerability scans, and recurring review from our internal cybersecurity working group. We respond to cybersecurity incidents and address identified cybersecurity risks through our internal cybersecurity working group and report any material findings and incidents to the audit committee of our board of directors.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to associates or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. These cybersecurity risks and other company risks are monitored and integrated into our enterprise risk management process. As part of this process, appropriate personnel will consult with subject matter specialists as necessary to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Our cybersecurity risk management approach includes: (i) an enterprise risk management process, which includes cybersecurity risks and is periodically refreshed; (ii) system vulnerability scanning; (iii) cybersecurity training for employees; (iv) penetration testing, which simulates cyber threats; and (v) third-party risk management for suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that allow for periodic auditing. We work to continually improve each of these processes with the goal of ensuring our cybersecurity strategy remains consistent with industry best practices.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident. Further, we conduct periodic tabletop exercises to test our cyber incident response plan.


text: As part of our cybersecurity risk management strategy, we periodically engage with assessors, consultants, auditors, and other third-parties to evaluate and test our systems. We also engage an independent Qualified Security Assessor to review our Payment Card Industry, or PCI, compliance.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition. See "Risks Related to Technology" included as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Audit and Finance Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit and Finance Committee receives an overview covering current and emerging cybersecurity threat risks and the Company's ability to mitigate those risks, and discusses these topics with our Chief Information Security Officer and Chief Technology and Digital Officer. Cybersecurity risk management is also considered at least annually during separate Board meeting discussions with management.


text: Our cybersecurity risk management strategy process is led by our Chief Information Security Officer, and Chief Technology and Digital Officer, and leverages the expertise of our Chief Financial Officer, General Counsel, and Chief Accounting Officer. Our Chief Information Security Officer and Chief Technology and Digital Officer have extensive prior work experience in roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, and Certified Ethical Hacker.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We invest in cybersecurity to protect intellectual property, customer data, manage reputational risk, and maintain business continuity across our devices, applications, and corporate networks. We strive to ensure ongoing compliance with the requirements under relevant standards including the Payment Card Industry Data Security Standards and relevant data privacy and protection laws and regulations. Additionally, our teams reference the standards, guidelines, and practices from the NIST Cybersecurity Framework (CSF) to align our cybersecurity program and risk management practices.


text: The foundation of our cybersecurity framework is based on written policies that govern different cybersecurity process areas. Risks are identified through various processes that employees perform through their daily operations and are mitigated, managed and/or governed through these established processes.


text: We also conduct tabletop exercises annually, to simulate responses to cybersecurity incidents and ensure accuracy and continuous improvement of the incident response plan. Our team of cybersecurity professionals then collaborate with other stakeholders across our organization to further analyze the risk to the Company and form detection, mitigation and remediation strategies.


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.


text: Leveraging our cybersecurity risk management processes, cybersecurity risk factors were identified, which are inherent to our business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which we are exposed. Additionally, mitigation of these risk factors is tracked by management as part of our cybersecurity maturity roadmap.


text: • Disruptions in the Company's supply chain could result in an adverse impact on results of operations. • Network compromise or equipment sabotage could impact the operations of the fulfillment center sites which could impact the revenue. • Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the company's reputation, disrupt operations, increase costs, and impact revenues.

stage1Category: None/Other


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable regulatory requirements and industry standards.


text: Our cybersecurity risk management program evaluates the risk associated when selecting third-party service providers. In addition to new vendor onboarding, critical vendors are reviewed annually to ensure understanding of their cybersecurity posture, and their responsibility in protecting our asset appropriately.


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A, Risk Factors-Risks Related to Our Business.


text: Cybersecurity Governance Cybersecurity is an area of focus for our board of directors, audit committee, and management. As part of our board of directors' overall responsibility for oversight of management's general risk identification and management activities, our the audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. Members of the audit committee review and discuss with management and our auditors quarterly the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security and review risk and mitigation steps taken by management related to data privacy.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our IT Security, external advisors, and legal teams. These individuals are informed about, and monitor the identification, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Risk management and strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to help safeguard our information systems and protect the confidentiality, integrity, and availability of those systems and our data maintained on them.

companyName: HashiCorp, Inc.


text: Managing Material Risks & Integrated Overall Risk Management We maintain risk management activities to identify, assess, prioritize, and address cybersecurity risks and we incorporate them into our overall risk management processes. Our Security team is responsible for performing cybersecurity risk assessments over various systems and processes on an ongoing basis. The results from risk assessment activities are reviewed to prioritize the mitigation of identified risks, and the need for risk mitigation may influence business or operational strategy, project roadmaps and timelines, or other decision-making, as needed.


text: Our Security Risk Committee is comprised of senior leaders across the company, and our Chief Security Officer briefs this committee on emerging risk topics and the company's top security risks on a quarterly basis. The Chief Security Officer also participates in our Risk Management Committee and presents on security risks as part of that group's discussion of enterprise risk.


text: Engagement of Third-parties on Risk Management We engage cybersecurity assessors, and other service providers, as needed, in evaluating and testing our risk management systems. These engagements help us to leverage specialized knowledge and insights to better align our cybersecurity strategies and processes with applicable industry standards. Our collaboration with these third parties includes regular control assessments, threat and vulnerability assessments, and consultation on security enhancements.


text: Oversee Third-party Risk We maintain standard processes to oversee and manage risks associated with use of third-party service providers. We conduct security assessments of third-party service providers with access to our information systems or sensitive data before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Such practices include recurring assessments of critical third-party service providers' cybersecurity programs and ongoing monitoring, detection, and response capabilities used by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-party service providers. In addition, our Legal team reviews the associated vendor contracts to ensure they include appropriate terms, including applicable security provisions.


text: Risks from Cybersecurity Threats We have not encountered risks from cybersecurity incidents or challenges that have materially impaired our business strategy, results of operations, or financial condition. Such risks may evolve in the future to have material impact, and our cybersecurity risk management processes, including those described here, may not always operate as designed or be effective. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Risks Related to Our Business and Operations: Problems with our internal systems, networks, or data, including actual or perceived breaches or failures by us or our partners, could cause our products to be perceived as insecure, underperforming, or unreliable, which would damage our reputation, and our financial results."


text: Given the potential significance of cybersecurity threats to our operational integrity and stakeholder confidence, our Board of Directors has established oversight mechanisms to promote effective governance in managing such risks.


text: Board of Directors Oversight and Management's Role Managing Risk The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The CSO is responsible for informing the Audit Committee on cybersecurity risks and presents to the committee at least semi-annually. Additional discussions with the Audit Committee or the full Board of Directors may occur on an as-needed basis. These briefings encompass various topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: The Audit Committee reviews and advises on Management's strategic decisions related to cybersecurity, offering guidance and approval for major initiatives when deemed appropriate.


text: Risk Management Personnel Cybersecurity risk management practices are ultimately led by our CSO, who has tenured experience in the cybersecurity field and is recognized within the industry. The CSO is supported by personnel across the Security organization in assessing, monitoring, and managing cybersecurity risks. Security personnel have relevant experience and credentials to perform their associated risk management responsibilities, and with the help of these individuals and teams, the CSO oversees governance programs, confirms compliance with relevant security requirements, manages known risks, and educates the company on cybersecurity.


text: Monitor Cybersecurity Incidents The CSO implements and oversees processes for the regular monitoring of our information systems, primarily through Security's Threat Detection & Response (TDR) team. This includes the deployment of technical security monitoring and alerting measures to identify potential incidents. In the event of a cybersecurity incident, the Security organization and relevant teams throughout the company follow a formalized, documented incident response plan. This plan includes immediate actions to assess and mitigate the impact of an incident, as well as subsequent actions to remediate and help prevent future incidents of a similar nature.


text: Risk Management and Strategy We have established a cybersecurity program, which includes maintaining policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these policies and processes into our overall risk management strategy. Our cybersecurity program is informed by standards established by the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS).

companyName: Absci Corp

ticker: ABSI


text: The audit committee receives periodic reports from the Senior Vice President and General Counsel, Chief Financial Officer, Vice President, Finance and Controller concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Regulus Therapeutics Inc.


text: We maintain processes for conducting internal and external cybersecurity risk assessments to identify cybersecurity threats that may adversely impact the confidentiality, integrity, or availability of our information systems or data residing therein. We generally conduct internal cybersecurity risk assessments and audits on at least a quarterly basis, which may include penetration testing and vulnerability assessments. We also regularly conduct cybersecurity simulation exercises, including in connection with our disaster recovery procedures. Additionally, we engage third-party service providers to support these efforts, including to conduct security testing on an annual basis.


text: We also engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes to assist us in our design and implementation of our cybersecurity policies and procedures and in our assessment and testing of our security safeguards. This includes a third-party managed detection and response team (MDR) to conduct ongoing network monitoring and to support incident management and threat assessment. Additionally, as a public company, we are subject to regulatory requirements and undergo audits of our financial statements, which include a review of related cybersecurity controls and information technology systems.


text: We maintain a cybersecurity awareness training program for employees, which is provided during onboarding and on an annual basis thereafter. Our training program includes simulated phishing campaigns, which are designed to increase awareness and detection and to equip our personnel with effective tools to identify and address cybersecurity threats.


text: Although risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through our audit committee.


text: Our Director of Information Technology is responsible for monitoring and assessing the the day-to-day management of cybersecurity risks. The individual who currently holds the position of Director of Information Technology has approximately fifteen years of IT management and cybersecurity experience. Our IT Committee, which is comprised of senior leadership team members across our Information Technology, Finance, Law and Innovation departments, is responsible for overseeing our cybersecurity policies and processes. Our IT Committee meets regularly with our Director of Information Technology to evaluate cybersecurity threats. We maintain an established process to notify the IT committee of identified cyber incidents and to provide an assessment of the potential criticality and impact of such incidents. We have also implemented procedures for response and containment efforts to address the actual or potential impact of identified cybersecurity incidents, as applicable.


text: Representatives from our IT Committee provide briefings regarding cyber matters to our audit committee on a quarterly basis, and directly to the full board of directors on an annual basis. Such briefings may include a discussion of cyber risks and applicable risk assessments, key updates regarding our cyber strategy and related initiatives, and the emerging cybersecurity threats that may impact our business.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").


text: Our legal department, a management committee (composed of our Senior Vice President and General Counsel, our Chief Financial Officer, and our Vice President, Finance and Controller) and a third-party service provider (collectively, the "Cybersecurity Risk Management Team") help identify, assess and manage the Company's cybersecurity threats and risks. Our Cybersecurity Risk Management Team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal audits, conducting third party threat assessments, and conducting vulnerability assessments to identify vulnerabilities.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the review of vendors' SOC 2 Type 2 reports if available, and a vendor security questionnaire. We are in the process of expanding the use of the security questionnaire to additional vendors.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a cybersecurity incident response plan, incident detection and response, a disaster recovery and business continuity plan, risk assessments, implementation of security standards, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the Cybersecurity Risk Management Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Senior Vice President and General Counsel, our Chief Financial Officer and our Vice President, Finance and Controller evaluate material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, system and organization controls reporting, and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, as well as contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President and General Counsel, Chief Financial Officer, Vice President, Finance and Controller. Our Senior Vice President and General Counsel has expertise as a Life Sciences executive, has had a key role in information technology and cybersecurity oversight for several years and has completed several cybersecurity trainings. Our Chief Financial Officer has several years of expertise performing audits as a public accountant, including audits over information technology controls, and has also completed several cybersecurity trainings. Our Vice President, Finance and Controller has expertise playing a key role with information technology general controls and control testing for the Company for many years, and has several years of expertise leading and performing audits as a public accountant, including audits over information technology controls. He has also completed several cybersecurity trainings.


text: These positions are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They are also responsible for preparing and approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Vice President and General Counsel, Chief Financial Officer and Chief Executive Officer. The Cybersecurity Risk Management Team and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: AUDACY, INC.


text: Risk Management and Strategy Cibus has processes designed to protect its information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability practices. The Company's cybersecurity team has dedicated personnel whose responsibilities include preventing and monitoring cybersecurity threats. The team has a cybersecurity incident response plan, which is a dynamic and flexible basic framework that includes processes designed to address interdiction and remediation, conducting initial investigations, gathering and analyzing data, reporting incidents to management, mitigating damage to the Company's informational assets and infrastructure, restoring normal services and system integrity, and implementing actions designed to prevent future cybersecurity incidents.

companyName: Cibus, Inc.

ticker: CBUS


text: Cibus has established procedures to identify, assess, and manage risks across the business, including risks related to cybersecurity. The Company's cybersecurity strategy includes risk management methodologies and analytics, which are designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in its ability to address cybersecurity risks and threats. Organizational risk assessments help management to assess threats and identify and investigate potential vulnerabilities to make risk management decisions and assign resources to mitigate risk. The Company's cybersecurity risk management strategy is incorporated into its business continuity plans, which include plans designed to address disaster recovery at its data centers and its holistic risk assessment procedures. Further, Cibus has a security awareness platform that provides its employees training on a variety of topics.


text: Cibus engages external resources that contribute to and provide evaluation of, its existing cybersecurity practices and organizational risk assessment systems. Further, Cibus has processes designed to identify, assess, and manage third party service provider risks when third parties handle, possess, process, and store the Company's material information.


text: As of the date of this Annual Report, Cibus does not believe that any past cybersecurity incidents have had, or are reasonably likely to have had, a material adverse effect on the Company's business, operations, or financial condition. However, there can be no assurance that the Company's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats, and it is possible that these events may occur and could have a material adverse effect on the Company's business, operations, or financial condition. See "Risk Factors—Risks Related to Cibus' Organization and Operations—Cibus' internal computer systems, or those of its third party contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of Cibus' operations." under the heading "Risk Factors" of this Form 10-K.


text: The Company's cybersecurity team is headed by its Director of Information Technology & Information Security, who works with the Company's cybersecurity team to identify cybersecurity risks and who has been in the information technology and cybersecurity industry for over 25 years and holds numerous technical certifications and cybersecurity-related certificates. The team members report via its established cybersecurity triage and outage workflow to the Cibus Cyber Security Council, which consists of the Company's CEO, President and COO, EVP and CSO, and members of the Company's legal and human resources teams. The Company's Cyber Security Council meets regularly to discuss the status of the cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of the Company's cybersecurity program. The Company's Cyber Security Council is also responsible for identifying, assessing, and managing the Company's exposure to material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats.


text: The Company's full Board of Directors oversees enterprise risks and has delegated oversight to the Audit Committee of the Cibus Board of the Company's data privacy and cybersecurity risks and provides input on the Company's cyber and information security strategy. The Council reports the status of the Company's cybersecurity program to the Audit Committee and, periodically, to the Board. The Board and Audit Committee regularly review these reports and discuss policies with respect to cybersecurity and information technology risks, including how these risks are being identified, assessed, and managed.


text: Cybersecurity Risk Management and Strategy Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations, and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.


text: We have implemented a cybersecurity program in accordance with our risk profile and business that includes, among other things, written policies, monitoring and filtering procedures, and employee training. We have also developed an incident response policy and procedure designed to facilitate the timely reporting and assessment of cybersecurity incidents.


text: Our cybersecurity risk management program, which is part of our enterprise risk management program, aims to identify risks related to the Company, including risks from cybersecurity threats. Our cybersecurity risk management program includes a number of components, including informal self-assessments and audits, penetration testing, and vulnerability assessments, that are conducted periodically by both internal and external resources. The Company also analyzes current and emerging cyber threats that pose a risk to the organization using various threat intelligence tools and services.


text: Governance Related to Cybersecurity Risks Our director of information technology ("Director of IT") is responsible for the strategic leadership and direction of the Company's information technology organization. The Director of IT has helped organizations define and implement information technology strategies for over twenty years. Prior to joining the Company, he served in senior information technology roles for several biotechnology companies. Along with members of our finance, legal, and operations teams, the Director of IT sits on a newly-formed cyber subcommittee ("subcommittee"). The subcommittee reports to the Chief Operating Officer ("COO") and Chief Financial Officer ("CFO"), and outputs from the Committee are provided by the COO and CFO to the Company's executive team and the board.


text: The board is responsible for informed oversight of our risk management process. The board administers this oversight function through various board standing committees that address risks inherent in their respective areas of oversight. The board has delegated oversight for cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company's policies and procedures with respect to cybersecurity risk management.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, see Item 1A. Risk Factors. The pharmaceutical industry is highly competitive and is subject to rapid and significant technological change, which could render our technologies and products obsolete or uncompetitive.


text: Cybersecurity Risk Management and Strategy The Company has implemented a cybersecurity risk management program that is designed to identify, respond to, protect against and manage cybersecurity threats and incidents. Our cybersecurity risk management processes include regular assessments of our cyber threat detection and response capabilities.

companyName: AlTi Global, Inc.

ticker: ALTI


text: We have established cybersecurity risk assessment processes, which include annual risk assessments using third-party consultants. Our Chief Information Security Officer ("CISO") has oversight over our information security policies and works with our internal IT resources and third-party managed IT support providers to facilitate the implementation of our cybersecurity risk assessment and management processes. Our cybersecurity risk management processes are designed to protect systems and data and contain preventive and detective controls, including internal and external testing. We also provide cybersecurity awareness training to our employees during onboarding and periodically thereafter, including through simulated phishing attacks.


text: We maintain processes designed to evaluate the security practices and controls of our critical third-party vendors that have access to our confidential information, which includes security questionnaires and third-party information security assessments, as applicable.


text: We maintain policies regarding our information security practices, including an incident response plan to coordinate response and mitigation efforts in the event we experience a cybersecurity incident. These policies require notification of cybersecurity incidents to our information security team, and if warranted based on the perceived level of severity of the incident, to members of our executive leadership. We have not identified any cybersecurity incidents or threats that have materially affected us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please consult "ITEM 1A. RISK FACTORS".


text: Cybersecurity Governance Related to Cybersecurity Risks Our Board considers cybersecurity risk as part of its overall risk oversight, and has delegated to the Audit, Finance and Risk Committee ("AFRC") responsibility for oversight of major risk exposures, including in relation to security, cybersecurity and privacy. At the management level, we have also established an Executive Risk and Compliance Committee ("ERCC"), which oversees the development and implementation of our risk oversight and management processes, including in relation to cybersecurity. The ERCC is comprised of members of our executive leadership from across the organization. Our CISO reports to the ERCC on identified material cyber risks (if any) and on the implementation of cybersecurity priorities. The members of the ERCC, in turn, are responsible for updating the AFRC, and, where required, our Board on key milestones and progress regarding identified material cyber threats.


text: Our CISO is responsible for advising on the strategic and operational processes related to our cyber risk management program. Our CISO has over two decades of cybersecurity experience, has served on a cybersecurity advisory board for a university, and is a Certified Information Systems Security Professional.


text: Cybersecurity Program Overview As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior Nuveen Real Estate professionals and our Advisor is a subsidiary of TIAA. As such, we are reliant on TIAA for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details TIAA has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Nuveen Global Cities REIT, Inc.


text: TIAA has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.


text: TIAA has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. This cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company in connection with its day-to-day commercial real estate, investment, and other operations.


text: TIAA has a comprehensive cyber attack response plan designed to inform the proper escalation (including, as appropriate, to certain of our executive officers and other representatives of our Advisor) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Priority Incident Response Team ("PIRT") composed of individuals from several internal technical and managerial functions investigates, remediates the event, and determines the extent of external advisor support required, including from external counsel, forensic investigators, and law enforcement. The cyber attack response plan sets out ongoing monitoring or remediating actions to be taken after resolution of an incident.


text: The Company relies on TIAA to engage external experts, including third-party IT service providers such as cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, including those applicable to the Company and other products, subsidiaries, and affiliates of TIAA. The Company also relies on TIAA's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the 12-month period covered by this report, TIAA has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Governance The Company's board of directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: TIAA's management, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Company. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, IT, and/or compliance personnel of TIAA.


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by our Director of Operations & Information Technology, who is responsible for management of our Information Technology program. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments, from our Director of Operations & Information Technology.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: Our Director of Operations & Information Technology regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team. Our Director of Operations & Information Technology has approximately 20 years of experience in his field, and Bachelor of Science in Information Technology Concentration in Information Systems Security and an MBA in Business Analytics.


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. The Cybersecurity Incident Response Plan, designed for our business environment, features the Director of IT and Operations as the incident coordinator. In the event of any suspicious activity or security breach, Energy Focus swiftly conducts an assessment to gauge the severity and scope of the incident, employing thorough investigation techniques to identify the root cause and affected systems. Immediate containment measures are then executed to prevent further unauthorized access or damage. Throughout the incident response process, transparent and timely communication is upheld with internal stakeholders and relevant external parties, ensuring alignment, and understanding of response efforts. Following successful mitigation and restoration of normal operations, Energy Focus conducts a comprehensive post-incident review to glean insights and lessons learned. These findings inform ongoing enhancements to our cybersecurity protocols, further bolstering our resilience against future threats. The incident coordinator oversees the detection, containment, and recovery procedures outlined in the plan. Effective communication protocols ensure timely notification to both internal and external stakeholders. Regular training sessions bolster staff preparedness, while post-incident reviews facilitate continuous improvement. Appendices offer essential contact information and tools necessary for incident response.


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our Information Technology team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber-attacks.


text: Risk Management and Strategy We maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Director of Operations & Information Technology to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST).


text: Our information technology department diligently monitors our daily operations, overseeing the security of our computer networks through implemented systems and processes aimed at safeguarding sensitive data. Utilizing encryption and authentication technologies, we fortify our systems against unauthorized access and data loss. This proactive approach ensures the integrity and confidentiality of our data, mitigating potential risks posed by cyber threats.


text: In assessing cybersecurity risks, we adopt a risk-based approach, particularly concerning third-party vendors integral to our operations. Vendors meeting specific criteria, including ownership and operation of information technology networks critical to our operations, undergo evaluation across various domains such as data security and operations management. Effective communication channels with these vendors are maintained to enable timely notification of any cybersecurity incidents that could impact our company.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems. For more information, please see Item 1A. Risk Factors - Increased Information Technology ("IT") security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services.


text: Our Director of Operations & Information Technology regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team. Our Director of Operations & Information Technology has approximately 20 years of experience in his field, and our Director of Operations & Information Technology holds certifications in cybersecurity from accredited information technology certification providers.


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our Director of Operations & Information Technology, Director of Risk Management and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, based on their risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Cybersecurity threats could have a material adverse effect on our business" in Part I, Item 1A.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to our Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, Chief Operating Officer (COO), Chief Financial Officer (CFO), Chief Technology Officer (CTO) and General Counsel (GC), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes knowledge related to cybersecurity and incident response, risk management, control analysis and corporate governance. Specifically, our CISO has over 23 years of cybersecurity experience and an advanced degree in information security and our information security team members have relevant cyber certifications and are trained in our key security solutions.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have established a comprehensive, enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. This program is seamlessly integrated into our overall risk management and internal control systems, subject to regular reviews by senior management. It significantly enhances the security, confidentiality, integrity, and availability of the personal and sensitive information we collect, create, use, and maintain.

companyName: CuriosityStream Inc.

ticker: CURI


text: By conducting regular risk assessments, we believe we effectively manage both internal and external cybersecurity threats. Our cybersecurity strategy is specifically tailored to our organization's size, scope, and business needs, emphasizing the protection of customer and employee data. Our security infrastructure includes advanced tools and protocols, such as firewall protections, secure user authentication, and up-to-date antivirus and internet security software, which we believe are fundamental components of our operational protocols designed to mitigate vulnerabilities and efficiently address security incidents.


text: We also assess and manage cybersecurity risks associated with our third-party service providers. We require the implementation of security measures that align with our established security policies and protocols as well as compliance with applicable legal requirements.


text: The ongoing improvement of our cybersecurity measures is overseen by our Vice President of Engineering, who is part of our Chief Operating Officer organization and manages the Information Technology team, and the designated Data Security Coordinator, encompassing regular program reviews, risk assessments, and employee training sessions to fortify our proactive security posture. We do not employ or engage any third parties to assist with cybersecurity consulting or monitoring other than technical support teams from our application vendors.


text: We believe our detailed incident response procedures enable us to effectively manage and mitigate the impacts of security breaches. Continuous monitoring and post-incident analysis further refine our security strategies, enhancing our protective measures. Our Board and the Audit Committee provide oversight over our cybersecurity efforts and stay regularly informed on cybersecurity matters, including emerging risks and mitigation strategies, to ensure informed governance over our enterprise risk assessments and cybersecurity approach. Cybersecurity matters are discussed regularly with senior management, and any significant cybersecurity events are promptly reported to the Board.


text: For additional information about cybersecurity risks, see Risk Factors, Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, harm to our reputation, disclosure or destruction of data, including user and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business.


text: Risk Management and Strategy Our generating facilities are part of the United States' energy infrastructure system and we face a myriad of cybersecurity threats. As such, cybersecurity is an area of continuous focus and we maintain a comprehensive cybersecurity risk management program with processes in place to assess, identify and manage cybersecurity risks. Our management and oversight of direct and indirect cybersecurity risks and our response to any cybersecurity incident is an integral part of our business.

companyName: OGLETHORPE POWER CORP


text: We have a long-standing focus on cybersecurity risks and compliance with applicable safety protocols. Our primary cybersecurity focus areas are plant infrastructure, data privacy, and outsourced services. Within these areas, we maintain multi-faceted, layered security programs designed to protect and preserve the confidentiality, integrity and availability of data and systems. Within our organization, we have a mature information technology security program and cybersecurity responsibilities are clearly defined. We regularly invest in technology and information system upgrades designed to prevent, detect and respond to attacks. We also perform tabletop exercises for executive leadership.


text: We require all employees to complete quarterly cybersecurity-related training and awareness programs. We review the cybersecurity practices of our vendors who provide goods and/or services that could impact our plant control systems and require contractors with access to our plant control rooms to complete annual cybersecurity-related training. We also require enhanced diligence reviews on all contractors and employees who have access to our plant control systems.


text: As part of the nation's critical infrastructure network, we are subject to certain mandatory reliability standards, which include cyber security requirements. We have a formal compliance program to establish, monitor and maintain compliance that includes comprehensive cybersecurity elements designed to protect and preserve our critical information and energy infrastructure systems. We reference industry and government frameworks and best practices to continuously improve our cybersecurity program and we participate in industry groups and information sharing exchanges to understand emerging cybersecurity trends and threats.


text: Georgia Transmission and Georgia System Operations provide us with certain transmission and system operations services that enable us to deliver energy to our members. As part of our risk management approach, we coordinate our cybersecurity preparedness and response planning with Georgia Transmission and Georgia System Operations.


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity to assess and enhance the effectiveness of our security programs. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support and audit our cybersecurity preparedness. We have also adopted cybersecurity incident response guidelines. As required by these guidelines, teams and plans are in place to respond to any cyber security incident, including internal and external communication responsibilities.


text: As of the date of this annual report, we have not experienced any cyber security incident that has materially affected our business. See "RISK FACTORS" for a discussion of cybersecurity risks that may affect us.


text: Our board of directors, along with the audit committee of our board of directors, is responsible for oversight of our cybersecurity risks and receives regular reports regarding our assessment and management of cybersecurity risks and information regarding any significant cybersecurity incidents.


text: Our board has adopted a policy regarding cybersecurity and delegated administration of the policy to our President and Chief Executive Officer.


text: Processes and systems for identifying and reporting cybersecurity and privacy risks (including emerging cybersecurity and privacy risks) and cybersecurity and privacy risk management deficiencies, and implementation of actions to address these deficiencies; and Processes and systems to integrate cybersecurity and privacy risk management and associated controls with management goals;

companyName: Cano Health, Inc.


text: Currently, our risk management and compliance committee, comprised of our chief executive officer, chief operating officer, chief financial officer, and the executive vice president of member and external relations, assesses and monitors material risks from cybersecurity threats. Members of our risk management and compliance committee receive regular updates regarding the prevention, mitigation, and detection of cybersecurity incidents and would oversee the response and remediation of any material cybersecurity incident. Our risk management and compliance committee also ensures our board of directors is briefed on cybersecurity risks, makes materiality determinations with regards to cybersecurity risks and monitors the active management of cybersecurity risks by internal and external teams. For additional information regarding our board of directors' risk oversight activities, see "DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE – Board of Directors' Role in Risk Oversight."


text: Cybersecurity Risk Management and Strategy GitLab's cybersecurity program was designed in alignment with industry standards and recognized best practices to identify, assess, and manage material risks from cybersecurity threats. Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, and financial impact. Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management. We also make judgments based on current data, assumptions about the risk, the company's risk tolerance, impact to confidentiality, integrity and availability, and reasonable analysis of costs associated with mitigating or reducing the severity of the risk. Our global incident response team iteratively evaluates security events for impact, using both qualitative and quantitative factors. Security incidents that are assessed as potentially material are escalated to designated members of our management and board of directors, as applicable.

companyName: Gitlab Inc.

ticker: GTLB


text: Our security program accounts for our significant interactions with relevant external third-parties and analyzes the potential risks introduced from doing business with them. These risks are continually assessed throughout the vendor lifecycle from onboarding to offboarding. We also engage in continuous monitoring of our cyber security risks and perform security assurance activities via independent, external third parties such as consultants, auditors, and assessors during our robust security certification audits, penetration tests, and bug bounty programs.


text: As of the date of this Form 10-K, to the best of our knowledge and based on available data, we have not experienced a material cybersecurity incident that has resulted in a material adverse impact to our business or operations. However, there can be no guarantee that we will not experience such an incident in the future. See Item 1A Risk Factors of this Annual Report on Form 10-K for more information on our cybersecurity risks and product vulnerability risks.


text: Our board of directors is responsible for overseeing and advising our company so that it functions as effectively as possible. The audit committee consists of a subset of the board of directors. The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. The audit committee performs oversight functions and meets regularly with management to review the company's business and operations, including the oversight of risks from cybersecurity threats. Management is responsible for and regularly discusses identifying, assessing, and managing material cybersecurity risks on an ongoing basis through programs led by the Chief Information Security Officer, Chief Legal Officer, and the Chief Financial Officer.


text: Members of senior leadership, including the Volato Group Board ("Board"), assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The senior leadership team includes senior leaders in areas of importance to Company priorities. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors. Members of senior leadership discusses enterprise risks and compliance programs with the Audit Committee of the Board. The Audit Committee makes reports to the Board, who also receive updates from members of senior management on material risks to the Company.

companyName: Volato Group, Inc.

ticker: SOAR


text: Risk Management and Strategy The Chief Technology Officer ("CTO") oversees the Company's information security program and is responsible for the day-to-day information risk management activities through the internal information technology team, and outside resources. The CTO, who has 32 years of Information Technology ("IT") and IT security experience, employs a team of information technology experts, including a Director of IT who is further supported by other members of the IT and technology department.


text: The Board, as part of its general oversight function, participate in discussions with senior management and amongst themselves regarding cybersecurity risks. With the assistance of the Company's most senior IT manager, we review annually the cyber and data security risks of our overall IT environment. We assess cybersecurity risk and the overall environment which includes devices, IT systems, websites, social media accounts, manufacturing technology/systems and suppliers/vendors. The oversight from the Board includes material changes to policies, procedures, employee training and elements of the overall environment, as necessary, senior management provides an update on emerging cyber threats. The Board has access, as requested, to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including Microsoft Azure CSPM and SOC 2. We use this framework, together with information collected from periodic manual assessments and automated testing, to tailor aspects of our cybersecurity practices given the nature of our assets, operations and business. The Company's processes to assess, identify and manage material risks from cybersecurity threats include, but are not limited to, the following: • The members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures and provide for continuity of operations. • The Company uses various systems to manage threats, for example, firewall protections, anti-virus protections, vulnerability scans, among others. Such systems are regularly reviewed for adequacy and potential enhancements. • The Company employs an information security and training program for our employees, including regular internal communications and ongoing end-user testing to measure the effectiveness of our information security program. • The Company utilizes a third-party service that provides real-time threat intelligence feeds and global threat data to enhance threat detection capabilities and proactively defend against emerging cyber threats. • We monitor the location of our geographic location of data sent to third party systems.


text: In 2023, we conducted an enterprise risk assessment that included an assessment of cybersecurity risk in context with other enterprise-level risks. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors", of this Annual Report on Form 10-K.


text: In the last three years, we have not experienced a material information security breach incident, or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data results ("Information Systems and Data").


text: The Company's Senior Vice President of Finance ("SVPF") and Director of Information Technology ("IT") help identify, assess and manage cybersecurity risk, including input from employees, and devote resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. The SVPF and Director of IT identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example maintaining manual and automated tools, conducting scans of threats and actors, evaluating threats reported to us, completing internal and external audits, and completing third-party threat assessments.


text: We have processes and standards to address cybersecurity matters and mitigate material cybersecurity risk. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, encryption standards, access controls, disaster recovery/business continuity plans, incident detection and response, antivirus protection, remote access security, and multi factor authentication. All employees are required to complete cybersecurity trainings at least once a year.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Director of IT along with management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.


text: The SVPF and Director of IT, who has over thirty years of experience in information technology and has both a computer science and information science degree, are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board of Directors. We support our information security program with external resources including cybersecurity software providers and advisors as needed.


text: We have a vendor management processes to manage cybersecurity risks associated with our use of these external providers that includes a risk assessment for each vendor, reviews of vendor audits and reports, and we also impose certain contractual information security obligations on vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of senior management, depending on the circumstances. Senior management works with the Company's cybersecurity incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's cybersecurity incident response plan includes reporting to the Board for certain cybersecurity incidents.


text: We face a number of cybersecurity risks in connection with our business. For more information about the cybersecurity risks we face, see the risk factor entitled "We and the third parties that support us rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems could have a material adverse effect on our business, including by not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" in Item 1A- Risk Factors.


text: Managing cybersecurity risks is an important component of the Company's approach to enterprise risk management. Our enterprise risk management approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's and customer's information; and (iv) protect our intellectual property.

companyName: Augmedix, Inc.


text: Risk Management and Strategy Our cybersecurity program focuses on the following areas: • Vigilance – We maintain 24/7 cybersecurity threat operations in order to rapidly detect, contain and respond to cybersecurity threats and incidents. • Systems Safeguards – We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, endpoint detection and response software that includes anti-virus and anti-malware functionality, data loss prevention mechanisms, access controls and ongoing vulnerability assessments and penetration testing. • Third-Party Management – We screen vendors, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented to users of our systems. The screening includes conducting sanctions and exclusions checks and security risk assessments. • Education – We provide training at hire and annually thereafter for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices. • Incident Response Planning – We have established and continue to maintain an incident response plan that addresses our response to a cybersecurity incident. We conduct annual testing of our incident response plan to measure effectiveness to improve our plan. • Communication and Coordination – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the technology, operations, legal, risk management and other key business functions (the "Cybersecurity Oversight Team"), as well as including our board of directors in an ongoing dialogue regarding cybersecurity threats and incidents. • Governance – Our board of directors' oversight of cybersecurity risk management is supported by our Compliance and Risk Management Committee, which includes our Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer and interacts directly with, and is provided relevant information by, our Cybersecurity Oversight Team.


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We regularly conduct vulnerability scans and penetration testing both internally and using third party vendors. We also engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures on an annual basis. The assessments include information security maturity evaluations, independent environmental security control reviews, and operating effectiveness. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews. We have been assessed and obtained a HITRUST r2 certification of our production environment.


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our information technology team oversees the day-to-day management of our cybersecurity program with regular reporting to representatives of our Cybersecurity Oversight Team. Our Cybersecurity Oversight Team has overall responsibility of our cybersecurity risk management program and procedures and reports regularly to the Audit Committee of our board of directors on cybersecurity matters. From a governance perspective, the Audit Committee as well as our Compliance and Risk Management Committee are provided with updates from the Cybersecurity Oversight Team regarding incidents as well as the policies, standards, processes and practices that the Company implements to address risks from cybersecurity threats. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, our board of directors will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.


text: The Cybersecurity Oversight Team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our Cybersecurity Oversight Team members each possess at least 5 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training. We believe this collective experience allows us to effectively manage risks emerging from cybersecurity threats.


text: The Cybersecurity Oversight Team works collaboratively across the Company to implement customized programs designed to protect and respond to cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response plan. Chief concerns are reported to our Compliance and Risk Management Committee when appropriate.


text: To date we have not experienced any cybersecurity incident that has materially affected our business, results of operation, or financial condition. We have also not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Although we have adopted various processes and preventative measures with the objective of preventing breaches and minimizing the risks from cybersecurity matters, given the nature of cybersecurity threats which are constantly evolving over time, there is no guarantee that the Company, including its business strategy, results of operations or financial condition, will not be adversely affected by such threats or that our preventative measures and processes will be effective. For further discussion of the Company's risk related to cybersecurity, see the risk factors "Our business and reputation may be impacted by IT system failures or other disruptions" and "If our products experience data security breaches, and there is unauthorized access to our customers' data, we may lose current or future customers, our reputation and business may be harmed and we may incur significant liabilities" in Part I, Item 1A of this Form 10-K.


text: Risk Management and Strategy Our risk management program is designed to identify, assess and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cyber security component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Technology Officer, who reports directly to our President and Chief Executive Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing and/or implementing new products, services and technology. We leverage people, processes and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detection tools designed to monitor, block and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems and network architecture, using internal cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Cyber Incident Response Procedure that provides a documented framework for responding to actual and potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees and to the Enterprise Risk Committee of our Board of Directors. The Cyber Incident Response Procedure is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Cyber Incident Response Procedure facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Cyber-attacks or other security breaches could adversely affect our operations, net income or reputation" in Item 1A. Risk Factors.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: P3 Health Partners Inc.

ticker: PIII