text: When a cybersecurity incident occurs, the Company prioritizes responding to and containing the threat and minimizing any business impact as appropriate. Each incident is evaluated, to determine the operational and financial significance, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact. An incident that reaches a specific level of severity is reported to the Cyber Incident Committee within pre-determined time frames. In such instance, the Cyber Incident Committee monitors the incident through resolution and post-incident analysis.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional discussion of cybersecurity risks or the impact of previous cybersecurity incidents, see Item 1A. Risk Factors "Risks Related to Our Business" in this Annual Report on Form 10-K.

companyName: Westrock Coffee Co

ticker: WEST

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: The Company's board of directors is responsible for overseeing the Company's risk management program and has designated its Audit & Finance Committee with specific responsibility for overseeing cybersecurity risks, among other risks. The Company's cybersecurity organization is led by our Director of Information Security ("DOIS"), who is responsible for assessing and managing material risks that result from cybersecurity threats, and reports to the Senior Vice President and Chief Information Officer ("CIO"). The CIO and the Audit & Finance Committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes.

stage1Category: Management Role

stage1Method: majority


text: Our DOIS has nearly a decade of experience within cybersecurity functions and his skillset includes security architecture and engineering, incident response and penetration testing. Our CIO joined the Company in 2023 and most recently served as CIO and VP at another large, publicly-traded organization and has held other vital IT positions over the course of his over 25 year career.


text: The Audit & Finance Committee regularly reviews our cybersecurity program with our CIO and management and reports to the Board of Directors. Cybersecurity reviews by the Audit & Finance Committee generally occur annually, or more frequently as determined to be necessary or advisable. Additionally, on a quarterly basis, members of the Audit & Finance Committee receive updates from our CIO regarding matters of cybersecurity, including, but not limited to, information on new and/or existing cybersecurity risks and management's response to such risks, cybersecurity and data privacy incidents, if any, and status on key information security initiatives.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: AUDIOEYE INC

ticker: AEYE


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through an internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our products) and implement appropriate changes.


text: We have implemented incident response processes in the event of a cybersecurity threat. Such incident responses are overseen by functional leaders and internal experts. In the event of a cybersecurity threat, security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for potential privacy impact. As part of the above processes, we have engaged external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards and obtained a SOC 2 Type II report.

stage1Category: Risk Management Process


text: We describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security and privacy breaches, computer viruses, and cyber-attacks could harm our business, financial condition, results of operations, or reputation." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cyber and data security threats. Members of the Board or Audit Committee receive periodic updates from senior management regarding our cybersecurity processes and risks. Members of management that comprise our incident response team include the following officers (or those with similar responsibility): Senior Director of Information Technology, Chief Operating Officer, Chief Financial Officer, Customer Success (if customers are affected), and Vice President of Human Resources (if employee data is affected). As part of our internal response policy, upon confirmation of a breach, a remediation process is initiated, led by our Principal Privacy Officer who chairs an incident response team. This team may include members from relevant departments such as Product Development, Information Technology, Finance, Legal, Marketing, Client/Customer Services and Human Resources, any other relevant units or departments affected by the breach and any additional personnel as deemed necessary.


text: The Principal Privacy Officer is responsible for overseeing the determination of whether a breach occurred, coordinating with third parties handling protected information, and ensuring compliance with legal obligations. Forensic investigators, provided through AudioEye's cyber insurance or as deemed necessary by the Principal Privacy Officer, will analyze the breach to understand its cause and extent. A communication plan will be developed by Marketing, Legal, and Human Resources to inform internal employees, the public, those directly affected, and regulatory authorities, as necessary to help ensure all notifications comply with relevant laws and regulations.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under NIST.

companyName: Hughes Satellite Systems Corp


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, cybersecurity maturity assessments, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have not experienced cyber-attacks or other malicious activities that materially disrupted our business. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business. We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Senior Director of Cybersecurity Infrastructure and Threat Hunting, Corporate Cybersecurity leads our information security organization responsible for overseeing our information security program. This individual has over 20 years of experience in various roles involving security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.


text: Legacy relies on information technology infrastructure and architecture, including hardware, cloud computing networks, software, people, and processes to manage protected, confidential, and personally identifiable information. Our business is at risk from, and may be impacted by, cybersecurity threats and incidents, including but not limited to attempts to gain unauthorized access to our systems or data. Similar threats and incidents may impact third parties with which we do business. We have invested and continue to invest in cybersecurity and data protection efforts, including technical, administrative, and organizational safeguards designed to protect our systems and data. However, we acknowledge that a future cybersecurity incident could materially harm our business, operating results, and financial condition.

companyName: Legacy Housing Corp

ticker: LEGH


text: The Company's cybersecurity efforts are directly overseen by our Director of Information Technology, who reports directly to our Chief Executive Officer. The Company's Board of Directors is made aware of cybersecurity incidents and threats, as appropriate, pursuant to corporate policy.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Our Vice President of Information Technology ("VP of IT") with assistance from our third-party managed services team, legal, quality, finance and human resources, identifies, assesses and manages the Company's cybersecurity threats and risks. The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual and automated tools, analyzing reports of threat actors, conducting scans of the threat environment, evaluating threats reported to us and coordinating with law enforcement concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; disaster recovery and business continuity plans; implementation of security standards; network security controls; access controls; system monitoring; and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified by the Company's senior management team. Also, IT consultants work with management to follow the National Institute of Standards and Technology framework for cybersecurity to mitigate cybersecurity threats that are more likely to lead to a material impact on our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms including outside legal counsel, cybersecurity consultants, threat intelligence service providers, managed cybersecurity service providers and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, reviews of vendor's written security program and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our collaborators, contractors, consultants or other third parties with whom we work, may fail or suffer security breaches, which could result in a significant disruption of our product development programs and can lead to adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; reputational harm; loss of revenue or profits; loss of customers or sales; disruption of our business operations."

stage1Category: None/Other


text: Our board of directors and audit committee addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Financial Officer and our VP of IT who has over 40 years of experience in information technology and cybersecurity and manages the Company's information technology infrastructure.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that includes processes designed for the identification, assessment and mitigation of cybersecurity risks in order to protect the confidentiality, integrity and availability of our critical systems and information. We have designed and assessed our program based on the Center for Internet Security (CIS) Controls standard and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: security controls and mitigation measures designed to manage and mitigate material risks from cybersecurity threats to our critical systems and information;


text: an IT and security team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and mitigation measures, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, IT and security personnel and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a risk-based approach to identifying and overseeing third party cybersecurity risks, including evaluating the cybersecurity processes of service providers and other vendors, and reviewing available security certifications and independent audit reports.


text: Although, to our knowledge, we have not experienced any material cybersecurity breach to date, we may experience cybersecurity incidents and face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see "Item 1A Risk Factors."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other IT risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives reports from management on our cybersecurity risks at least semi-annually. In addition, management updates the Audit Committee regarding cybersecurity matters, as necessary, including any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities and the full Board periodically receives briefings from management on our cybersecurity risk management program.


text: Our management team is responsible for assessing and managing risks from cybersecurity threats. The Vice President, Global IT and Senior Vice President, Risk and Internal Controls have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. They provide briefings to the management team, including the Chief Financial Officer/Chief Operating Officer and the General Counsel and Secretary, as well as the Board and the Audit Committee. Their briefings include topics such as threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us. The briefings also cover alerts and reports produced by security tools deployed in our IT environment. Our Vice President, Global IT has over 20 years' experience leading teams in cybersecurity, and designing and securing critical IT infrastructure in the healthcare, biotech and sports entertainment sectors. Our Senior Vice President, Risk and Internal Controls has more than 30 years' experience designing, implementing and leading risk management, internal control and compliance programs, including cybersecurity, data privacy and business resilience, in global organizations.


text: ISG maintains a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and the Company's client-facing products. We regularly assess the threat landscape, taking a holistic view of cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: Information Services Group Inc.

ticker: III


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology. ISG performs annual assessments, by two independent third parties, against the International Organization Standardization ("ISO") 27001 Information Security Management System requirements for which we maintain certification. ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials. In 2024, the Company achieved a System and Organization Controls 2 ("SOC2") Type 1 against our GovernX platforms, and we are preparing to continue maturity in this area by seeking to attain SOC2 Type 2 in 2025.


text: The Company's cybersecurity efforts are led by the Chief Information Security Officer (" CISO "), who reports to the Chief Information Officer ("CIO") and has responsibilities that cover the management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has proven cyber operations and cyber risk management experience, having previously worked for UK law enforcement and leading organizations in the financial services, health and advertising sectors. Our CISO also holds relevant cyber management qualifications, such as being a Certified Information Systems Security Professional. The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cybersecurity disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents. Cybersecurity risk is maintained and managed under our Information Security Management System framework with oversight through our internal Executive Board ("IEB") and our Board of Directors, which has delegated responsibility for cybersecurity risk to our Information Security Committee ("ISC").


text: Cybersecurity is an important area of focus for our Board of Directors. The Board of Directors reviews and discusses with our CIO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, any significant cybersecurity incidents, and the emerging threat landscape. Our CIO discusses the same cybersecurity topics covered with the Board of Directors with the IEB. In addition, the IEB makes decisions on resourcing and project prioritization in support of our cybersecurity and compliance initiatives.

stage1Category: Board Governance


text: Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely our Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager. The ISC oversees the management of processes for identifying and mitigating cybersecurity risks, material vulnerabilities and high-rated incidents to help align our risk exposure with our strategic objectives. The ISC meets quarterly and receives additional ad-hoc briefings from the CISO as and when required.


text: In the event of a major security incident, certain members of the ISC form part of our Incident Management Team ("IMT"). The IMT follows our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership, the IEB and the Board of Directors, as appropriate.


text: For the evaluation of our security controls, ISG engages third-parties services to conduct penetration testing, independent audits or provide consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of our security controls. We also share and receive threat intelligence which we utilize to bolster defenses against active threats. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across our security domain.


text: ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, through the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network. We maintain processes and procedures to continuously assess third-party cybersecurity risk and include security and privacy addendums to our contracts where applicable. We seek to work directly with any suppliers to address potential deficiencies when identified.


text: To mitigate the risk and negative exposure of personal data being breached or inadvertently shared outside of ISG, we maintain a data protection framework that includes policies, procedures, guidance and records. This includes policies and procedures regarding the rights and usage of personal and client data. ISG employs a Data Privacy Manager who briefs the ISC on privacy matters as part of the quarterly ISC meetings. The Data Privacy Manager completes an internal audit annually and works with a specialist third party to complete an external Data Protection Compliance review.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating cybersecurity threats or incidents, and such threats or incidents may have a material adverse effect on us. While ISG maintains cybersecurity insurance, the costs related to cybersecurity threats or service disruptions to both ISG and our clients may not be fully insured. For more information regarding the risks we face from cybersecurity threats, see the risks identified under "Risks Related to Data, Cybersecurity and Confidential Information" found in "Part 1A, Risk Factors" of this Annual Report on Form 10-K.


text: As a Company selling some products and performing engineering services for defense applications, we may be the target of cyber-attacks from a variety of threat actors. Cybersecurity threats include attacks on, or other attempts to infiltrate, our information technology (IT) infrastructure and the IT infrastructure of our customers, suppliers, subcontractors and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, including attacks targeting the security, confidentiality, integrity and/or availability of the hardware, software and information installed, stored or transmitted in our products, including after the purchase of those products and when they are incorporated into third-party products, facilities, or infrastructure.

companyName: Vuzix Corp

ticker: VUZI


text: Our Cybersecurity Program Our products and services are normally classified as EAR 99 (items not designated under the control) by the U.S. government, but our defense customers may ask us to make some alterations for the environments in which the products will be used. Moreover, our products sold for defense applications are integrated with our customers' products. Given the nature of our business and the cybersecurity risks we face, we have instituted a cybersecurity program for identifying, assessing, and managing cybersecurity risks, which include material risks from cybersecurity threats to our internal systems, our products, services and programs for customers, and our supply chain.


text: Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) standards, among others. The program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operations. We, or third parties we contract with, monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications. Incident Response.


text: Our cybersecurity program includes monitoring for potential security threats that may lead to vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage an incident response team based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and/or the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident response process is also designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis. Third Party Service Providers.


text: We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery. Our main external service provider is US-based and utilizes a 24 x 7 x 365 Service Operation Center (SOC). Program Assessment.


text: We regularly evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role. The Chief Financial Officer regularly reports to the Board of Directors on the status of the Company's cybersecurity program and provides the Board of Directors with the annual assessment by a third party on the Company's cybersecurity program.


text: Cybersecurity risks are also included with the Company's annual business risk assessment which is provided to the Board of Directors.


text: Cybersecurity Risk Management and Strategy In the normal course of business, we may collect and store personal information, customer information, and certain sensitive company information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding trial participants in connection with clinical trials, sensitive third-party information, and employee information. To protect this information, our existing cybersecurity policies require monitoring and detection programs, network security measures, and encryption of critical data. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We have established our disaster recovery plan, and we protect against business interruption by backing up our major systems. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Zomedica Corp.

ticker: ZOMDF


text: Our cybersecurity program is led by our Vice President of Technology Innovation and includes a team of information technology professionals. The program is further strengthened through support of our General Counsel. These teams work closely together to support and bolster our cybersecurity program, which incorporates industry-standard frameworks, policies, and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity team informs our Audit Committee on information security and cybersecurity matters as needed.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to our Business" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and overseen by our information technology function, that are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular exercises and tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Generation Bio Co.

ticker: GBIO


text: Based on an assessment using the previously described risk management program, we do not believe that there are currently any known risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. See " Our internal information technology systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business " in Part I, Item 1A, "Risk Factors" for additional information.


text: Our Audit Committee provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if any.


text: Our Senior Director of Information Technology, or IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Director of IT has over 25 years of experience in building, running, and managing diverse functional areas of IT, including but not limited to enterprise cybersecurity, IT infrastructure, operations, business continuity, and service delivery. He began his IT career overseeing datacenter operations for a pharmaceutical company and has held multiple IT leadership positions at biotechnology companies, including serving as the director of cybersecurity and infrastructure at a biopharmaceutical company prior to joining us over four years ago.


text: We have also established a cross-functional cybersecurity working team led by our chief financial officer serving as the chair and consisting of executive-level leaders, that is responsible for reviewing, revising and testing our cybersecurity policies and procedures.


text: In an effort to deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention trainings, which cover a range of timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This incident response and prevention training functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Our information security program is managed by a dedicated Chief Information Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Chief Information Officer provides periodic reports to our Board of Directors, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: NorthEast Community Bancorp, Inc./MD/

ticker: NECB


text: Risk Management and Strategy We face various cybersecurity risks and threats that could have a material adverse effect on our business, operations, financial performance, liquidity, and reputation. We have implemented processes and systems to identify, assess, and manage these risks and threats, as well as to prevent, detect, and respond to any cybersecurity incidents that may occur, which is integrated into our overall risk management process. We also have a comprehensive cybersecurity strategy, policy, and program that aligns with our business objectives and risk appetite. We regularly review and update our cybersecurity strategy, policy, and program to address the evolving nature and scope of cybersecurity risks and threats. In addition, we consider the cybersecurity practices of our third-party service providers, through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help identify and mitigate cybersecurity risks associated with those providers.

companyName: WEYCO GROUP INC

ticker: WEYS


text: We comply with various laws, regulations, standards, and guidance related to cybersecurity, such as the Sarbanes-Oxley Act of 2002, the Payment Card Industry Data Security Standard, the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the SEC's guidance on cybersecurity disclosures.


text: During the fiscal year ended December 31, 2024, we did not experience any cybersecurity incidents that materially impacted, or are reasonably likely to materially impact, our business strategy, results of operations or financial condition. Please refer to the risk factors described in this report under Item 1A, "Risk Factors," for a discussion of the potential impacts of future cybersecurity events.


text: Our Information Technology ("IT") security department, led by our Chief Information Officer ("CIO") and overseen by our Vice President of Information Systems ("IS"), holds primary responsibility for assessing and managing cybersecurity threats. Our CIO has more than 35 years of experience in IT and holds a bachelor's degree in Management of IS; his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Vice President of IS has more than 20 years of experience in various IT and IS roles, and holds a bachelor's degree in Accounting and Finance.


text: A team of IT Specialists (including a dedicated Senior Cybersecurity Analyst) at our Company monitors cybersecurity and operational risks associated with information security and system disruption. This team employs measures aimed at protecting against, detecting, and responding to cybersecurity threats, and has implemented processes and procedures in line with our information security management system to bolster and advance resilient programs. This encompasses:


text: Continuously developing and evaluating our program in accordance with the NIST Cybersecurity Framework. This Framework serves as a reference to aid in the identification, assessment, and mitigation of cybersecurity risks pertinent to our business operations.


text: Engaging third-party IT security vendors to conduct ongoing assessments and monitoring of our networks and devices. Additionally, we routinely collaborate with assessors, consultants, and other third-party entities to review our cybersecurity program. These efforts aim to identify areas requiring sustained attention, enhancement, and alignment with regulatory requirements. Certifications held by our cybersecurity consultants include but are not limited to: CISSP, CISM, CCNP, and CMMC-RP.


text: Conducting regular cybersecurity awareness training, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees.


text: Cybersecurity Governance Our Audit Committee is provided with regular updates from management concerning cybersecurity developments, significant cybersecurity threats, risks and processes implemented to address these risks. Our Audit Committee receives presentations on cybersecurity topics from management as part of the Committee's continuing education on topics that impact the Company. Furthermore, management informs the Audit Committee as deemed necessary, about any notable cybersecurity incidents.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: AXT INC

ticker: AXTI


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, VP of Finance, and Controller to manage the risk assessment and mitigation process.


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test and audit our safeguards. We maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and on the information and systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "Cyber-attacks, system security risks and data protection issues could disrupt our internal operations and cause a reduction in revenue, increase in expenses, negatively impact our results of operation or result in other adverse consequences."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The chair of our Audit Committee has experience in assessing and managing cybersecurity risk.


text: Our management committee on cybersecurity, which includes our Chief Financial Officer and members from finance and IT, is primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Financial Officer has had supervisory responsibilities over IT for over 30 years and personally engages our employees in training for cybersecurity. Our lead IT Senior System Engineer has over 20 years of direct IT employment and is a Microsoft Certified System Engineer, a Cisco Certified Network Associate and a Sun Certified System Administrator. One of our Controllers has over 15 years of Sarbanes Oxley compliance training and auditing, including auditing compliance regarding IT. Our VP Finance and Corporate Controller has over 20 years as an employee of AXT and has a thorough understanding of our specific IT systems.


text: Our management committee on cybersecurity oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which o ur management committee on cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include regular communication and reporting from our IT manager, alerts and warnings through the use of technological tools and software and the results of cybersecurity systems testing from a third-party consultant.


text: Our Chief Financial Officer provides briefings to our Board of Directors and the Audit Committee regarding the Company's cybersecurity risks and activities, including cybersecurity systems testing, activities of third parties, and the like.


text: We believe cybersecurity is a critical component of our overall approach to developing, implementing, and maintaining a security environment that safeguards our information systems and protects the confidentiality and integrity of our data. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: WideOpenWest, Inc.

ticker: WOW


text: Cybersecurity Risk Management and Strategy The Company integrates cybersecurity into its overall approach to Enterprise Risk Management through a continuous evaluation of our environment for risks that could impact our overall posture. The Company's policies and procedures to address cybersecurity risks and threats are developed in conjunction with industry standards, best practices, and regulatory requirements. We ensure all employees and contractors are aware of cybersecurity risks through regular communication and required annual trainings.


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and next generation detection platforms, security automation orchestration and response, and protection platforms designed to stop initial malicious activity. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we have a shared responsibility model with these third parties and require them to implement security programs commensurate with their risk. We cannot ensure that in all circumstances their efforts will be successful.


text: To operate its business, the Partnership engages certain third-party vendors to perform a variety of functions. The Partnership seeks to engage reliable, reputable service providers. Depending upon the nature of the services and the sensitivity of the data that a third-party service provider processes, the Partnership's vendor management procedures include reviewing the cybersecurity procedures, imposing contractual requirements, and conducting as needed periodic reassessments. The Partnership seeks to further enhance this review to expand the scope and depth of this analysis.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage a third-party vendor to conduct an annual payment card industry data security certification of our security controls protecting payment information, as well as third-party penetration testing of our cardholder environment and related systems. The results of these assessments are reported to the Audit Committee.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of customers and adversely affect our business and results of operations. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, financial condition and results of operations.


text: To manage risks posed by third party vendors, the Company requires mutual non-disclosure agreements and master service agreements which include minimum requirements related to cybersecurity, data security, and breach of reporting. Potential threats posed by third party vendors are assessed according to potential level of impact and risk to our overall cybersecurity. Additionally, we obtain SOC-1 Type II and SOC-2 reports from vendors with a financial reporting impact.


text: Cybersecurity Governance The Senior Director of Information Security and IT Compliance and the Senior Vice President of Information Technology report to our Chief Technology Officer, who is responsible for overseeing the information security program. The Senior Director of Information Security and IT Compliance is a Certified Information Systems Security Professional with over 20 years of experience in cybersecurity, including continuous cybersecurity threat and risk monitoring. Team members who support our information security program have relevant educational and industry experience; these include but are not limited to: offensive security, advanced incident response, and advanced detection development. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: The Board oversees our annual enterprise risk assessment, which is completed with the assistance of third party consultants, where we assess key risks within the company, including security and technology risks and cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from management, including from the Chief Technology Officer, regarding matters of cybersecurity. These updates include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Any cybersecurity incidents are immediately reported to the Core Incident Response Team ("Core IRT") which includes key members of management from across the organization. The Core IRT will communicate the incident and potential risks to the Chief Executive Officer. The Core IRT and CEO will determine if the incident should be communicated to the Board of Directors. Any incident that is reported to the Board of Directors includes continuous follow-up as well as detailed documentation provided to the Audit Committee. To date, the Company has not experienced a material cybersecurity incident.


text: The Partnership's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems, and those that are offered to residents and tenants, are integral to the operation of the business. The Partnership utilizes these systems, among others, for financial analysis, management, and reporting, for facilitation of operations, including for the initiation, generation, and completion of resident leasing, for internal communications, and for various other aspects of the business.


text: The Partnership's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Partnership has implemented or is in the process of continuously evaluating, testing and updating various information security processes and policies designed to identify, assess and manage material risks from cybersecurity threats to the Partnership's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to the Partnership's residents' and employees' personal data.


text: Cybersecurity Risk Management and Strategy Hanover recognizes that risk is an intrinsic aspect of all areas of our business and activities. Effective risk management is vital to our success. A comprehensive risk management approach is fundamental to maintaining the trust of our customers and the efficacy of our financial services.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: Cybersecurity is a critical component of our risk management process. We recognize that no single technology, process, or business control can effectively prevent or mitigate all risks, thus we use a variety of tools including multi-factor authentication and antivirus and firewall protection, to help identify, protect, detect, respond to, and recover from cyber threats. These individual technologies work together as part of our strategy to minimize risk. This strategy is tested through audits and independent program assessments, as well as through additional exercises with our Managed Service Provider, designed to assess effectiveness. The Managed Service Provider actively manages our firewalls, multi-factor authentication, antivirus, and Azure environment. Our Managed Service Provider also reviews our cybersecurity program on a quarterly basis and provides recommendations toward best industry practice. Our cybersecurity program is continually evolving to align with NIST standards, and we regularly monitor our progression toward these standards.


text: Our Audit Committee is responsible for overseeing our cybersecurity and data privacy risks. Our cybersecurity program is led by the Hamilton Company's Chief Financial Officer, who, along with the Hamilton Company's Director of Information Technology who has been with Hamilton for 39 years, provide regular updates each quarter to the Audit Committee regarding this program, including information about the cybersecurity threat landscape, investments in infrastructure and opportunities to protect and enhance the Company's systems and security of products and operations. The also Board receives periodic briefings from management regarding cybersecurity activities and initiatives The Partnership's cybersecurity program is designed to safeguard the confidentiality, integrity and availability of data and systems within the Company's environment to effectively support our business objectives and customer needs. Our commitment to cybersecurity focuses on enhancing our prevention, monitoring, and detection response capabilities to identify and respond to evolving threats. We believe cybersecurity is the responsibility of every employee of the Hamilton Company, and it is prioritized each year. We regularly test, educate, and share best practices with employees of the Hamilton Company to raise awareness of cyber threats through a comprehensive security awareness training program. Our Managed Service Provider is responsible for testing our ability to restore our critical infrastructure on a quarterly basis. Additionally, our incident response and disaster recovery plans are reviewed and updated annually. During 2024, we have not encountered cybersecurity challenges that have materially impaired our operations, business strategy or financial condition.


text: Risk Management and Strategy The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage third-party cybersecurity firms to assist with network and endpoint monitoring, cloud system monitoring, and assessment of our incident response procedures, risk identification and assessment of material cybersecurity threats.

companyName: McEwen Inc.

ticker: MUX


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor security and information events on a real-time basis to respond to threats as they occur; Monitor emerging data protection laws and implement changes to our processes to comply; Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; Update key employees regularly on phishing email and other cybersecurity risks; Employ artificial intelligence assisted cybersecurity monitoring capabilities; and Complete regular updates to key software and infrastructure.


text: Management has not identified any specific risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See " Item 1A. Risk Factors, Our business could be negatively impacted by security threats, including cybersecurity threats, and other disruptions. " above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. The Audit Committee periodically receives an overview of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified, and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President Finance. The Vice President Finance is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan. Together with the General Counsel, information technology staff and outside consultants that comprise our cybersecurity management team, we collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks.


text: Hanover's Enterprise Risk Management ("ERM") framework leverages the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") principles. This alignment is intended to bolster effective risk management practices that meet regulatory expectations. ERM considers all eight major risk categories including credit, market, liquidity, operational, compliance, reputation, legal, and strategic risk and further enhances the Company's financial resiliency by integrating ERM with our capital and strategic planning processes. Cybersecurity is a major component of the broader operational risk category given the increase in risk due to the increased reliance on technology both for operating processes and delivery channels.


text: Hanover is committed to safeguarding the confidentiality, integrity, and availability of our information assets, including in particular customer information, and information technology environment. The objective of our cybersecurity program is to minimize the potential and impact of cyber threats. Our comprehensive cybersecurity program is designed based upon the National Institute of Standards and Technology ("NIST") cybersecurity framework and in accordance with applicable industry guidance inclusive of Federal Financial Institutions Examinations Council ("FFIEC") Information Security program guidance and NYDFS guidance and requirements.


text: Our cybersecurity governance framework includes documented policies, procedures, and controls designed to mitigate cybersecurity risk. We also perform regular risk assessments of our infrastructure, network architecture, and software/systems using current threat intelligence received from a variety of sources. We employ various preventative and detective controls to block, monitor, and alert for suspicious activity. Additionally, we engage third-party experts to perform periodic internal and external assessments, including penetration testing and vulnerability scanning. We also maintain an ongoing education and training program designed to increase employee awareness and gauge risks relative to the human element. Moreover, we maintain a third-party risk management program designed to identify, assess, and mitigate risks, inclusive of cybersecurity risk, associated with third-party service providers and Hanover's supply chain vendors. Lastly, we engage third-party audit firms to periodically assess our IT general controls and information security.


text: We also maintain an Incident Response Plan that provides a structured framework for addressing potential or actual cybersecurity incidents. The Incident Response procedures and detections/prevention mechanisms are continuously refined to address evolving threats and alerts. This Plan includes the timely notification, escalation, and reporting of cybersecurity incidents to the Bank's Operational Risk Management Committee, Enterprise Risk Management Committee, and the Board of Directors and/or the duly designated ERM Committee of the Board of Directors. It also includes for the timely notification to regulatory agencies, including but not limited to the FDIC, DFS, FRB and SEC as required or deemed appropriate. We also undertake periodic simulations and tabletop exercises to test our Incident Response Plan and ensure business resiliency and proper incident response management.


text: Cybersecurity Governance Our Senior Information Security Officer ("SISO"), who is supported by a team of specialized Information Security and Third-Party Risk Management Analysts, is primarily responsible for the development, oversight, and administration of our Information Security, Business Continuity, and Vendor Risk Management Programs. The SISO has over 25 years of experience in information security, information technology, and enterprise risk management and holds certifications as both a Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Auditor ("CISA"). The SISO is an active member of the following management-level committees: Incident Response Committee, IT Steering Committee, Change Control Committee, Product Management Committee, Project Management Committee, and Operational Risk Management Committee ("ORMC"). The SISO reports to the ORMC on a quarterly basis, or more frequently if needed, regarding the effectiveness and status of the cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments.


text: The SISO reports directly to the Chief Risk Officer ("CRO"), who has over 35 years of experience in enterprise risk, audit, and compliance. The CRO maintains oversight of entity-wide risk management, inclusive of but not limited to cybersecurity risk.


text: The SISO meets regularly with and works collectively with the Bank's Chief Information Officer ("CIO") and various members of the Information Technology Department as well as third-parties we may employ to assist in this area. The CIO has over 30 years of experience in Information Technology.


text: The SISO also reports to Hanover's Board Enterprise Risk Management Committee on a quarterly basis, or more frequently if needed. Similar to the SISO's management-level reporting, the SISO reports on the overall cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments. The SISO also provides an annual Information Security report to the full Board of Directors and executive leadership team on the overall cybersecurity program, including material risks, key risk indicators, and emerging trends.


text: The ultimate responsibility, among management, for effective risk management, including cybersecurity risk, resides with the Chief Executive Officer ("CEO"). The Bank's CEO and SISO annually certify compliance to the NYSDFS as required under DFS regulations.


text: Material Cybersecurity Risks, Threats, and Incidents Our cybersecurity program has been designed to mitigate risks from cyber-attacks. However, even with a strong internal control environment designed to mitigate risks, Hanover is keenly aware that risks cannot be entirely eliminated. Notwithstanding our cybersecurity program's effectiveness, the threat posed by cyber-attacks remains substantial. Additionally, we maintain cybersecurity insurance designed to further reduce residual risk. Nevertheless, due to the continuously shifting and evolving threat landscape and global geopolitical events, a portion of cyber risk remains inherently beyond full mitigation.


text: While we have experienced cybersecurity incidents in the past, we do not believe any of these incidents have materially affected or are reasonably likely to materially affect the Company or its operations and financial condition.


text: Risk Management and Strategy Our operations include the creation, collection and maintenance of sensitive information, including proprietary and confidential business information, intellectual property, third-party information and employee information. To protect this information, we use external and internal services to managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats on a constant basis. In addition, we use multi-factor authentication (MFA) for external use, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impacts. We establish incident response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: We have implemented a Data Protection Policy, or the DPP, in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of our information, data and assets, and to manage identified material cybersecurity risks. The DPP was prepared using relevant guidance issued and technology standards that are used across various industries. It applies to all entities who are using our equipment and resources, including but not limited to, employees and temporary workers. Our Senior Director, Information Technology, is a certified information security officer (CISO). He is primarily responsible for implementing and overseeing the DPP and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.


text: Our DPP includes an incident response process that includes reporting thresholds and follows standardized identification and authentication practices. If an incident is identified, it is documented by our Senior Director, Information Technology, who is required to report the incident to management.


text: We work with third-party service providers from time to time that assist us to identify, assess and manage cybersecurity risks, including professional SEIM SOC and other services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing.


text: No risks from cybersecurity threats have occurred that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director, Information Technology, who reports to our Sr. Vice President, Operations. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our incident response process involves management, who participates in our disclosure controls and procedures.


text: Our incident response process is designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with our incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to our Board of Directors for certain cybersecurity incidents.


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. Our Chief Financial Officer and IT consultant provide periodic briefings to the Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, if any, cybersecurity systems testing, activities of third parties, and the like.


text: See " Risk Factors – Our internal computer systems, or those used by our third-party contractors or consultants, may fail or suffer security breaches, resulting in liability and harm to our reputation, which could negatively affect our business, results of operation and financial condition. We may face liability if we breach our obligations related to the protection, security, nondisclosure of confidential information or disclosure of sensitive data or fail or are perceived to fail to comply with applicable data protection laws and regulations, or consumer protection laws, regulations and standards. "


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. As a financial services company, cybersecurity threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This strategy includes employee training, innovative technologies, and policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response.


text: The Company leverages a variety of industry frameworks and regulatory guidance to develop and maintain its information systems and cybersecurity program, including but not limited to Interagency Guidelines Establishing Information Security Standards, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook (with particular emphasis on the FFIEC's Information Security and Business Continuity Management Handbooks), FFIEC Cybersecurity Assessment Tool, Gramm-Leach-Bliley Act ("GLBA") 501(b), and the Center for Internet Security ("CIS") Critical Controls Framework. In addition, the program leverages certain, third-party benchmarking, audits, and third-party threat intelligence sources to facilitate and enhance the effectiveness of the program.


text: Core activities supporting the Company's strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Company and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups stored at off-site locations and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations, and these third-party vendors continue to be a source of operational and informational risk. Accordingly, the Company utilizes a third-party risk management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.


text: As indicated above, supporting the operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. As such, the Company engages third-party consultants and independent auditors to conduct penetration tests, cybersecurity risk assessments, external audits, and program development and enhancement where applicable.


text: Cybersecurity Governance Management Oversight. The Chief Technology Officer oversees the Information Technology Department which, among other things, is responsible for identifying, assessing and managing material risks from cybersecurity threats and has more than thirty years of experience in the information technology field. The Chief Technology Officer is a member of various management committees and participates in Board of Directors' meetings as well as Audit Committee meetings where the overall status of information technology and security is discussed including the related policies and risk assessments. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for policy and program enhancements.


text: Further, the Chief Technology Officer is a member of the Compliance Committee chaired by the Chief Compliance Officer, which consists of members of senior and executive management, as is it charged with maintaining Bank-wide compliance with relevant statutes, regulations, and interpretations as well as consumer protection.


text: Board Oversight. The Board of Directors is responsible for reviewing the overall policies and practices for risk management, including delegation of oversight for particular areas of risk to the appropriate subcommittees. Collectively, the Board of Directors and its subcommittees are responsible for discussing with management major financial risk exposures as well as significant operational, compliance, reputational, strategic and cybersecurity risks, and the steps management has taken to monitor and manage such exposures to be within the Company's risk tolerance.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed to align with industry standards and incorporates best practices such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: We have also established an interdisciplinary Cybersecurity Incident Response Team ("CIRT"), which is responsible for our incident response plan, our security controls, and for assessing incidents reported by our information technology security team. In addition, our cybersecurity risk management program includes: Monitoring and evaluation of our vulnerability performance.


text: Implementation of processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our critical systems and information. For any agreements with service providers that do not contain acceptable protections, we are working to put them in place on an ongoing basis.


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment. We use a third-party consultant to provide us with advisory, project execution, and operational support in connection with cybersecurity and to conduct NIST assessments and vulnerability evaluations. Cybersecurity awareness training of our employees, contractors, incident response personnel, and senior management.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches and geopolitical tensions or conflicts, such as the ongoing war in Ukraine or conflicts in the Middle East, may create a heightened risk of cyberattacks."


text: Cybersecurity Governance Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors encourages management to promote a culture that incorporates risk management into our corporate strategy and day-to-day business operations. Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: Management discusses strategic and operational risks at regular management meetings and conducts specific strategic planning and review sessions throughout the year. Throughout the year, senior management reviews these risks, including with respect to cybersecurity, with the Board of Directors at board meetings from time to time as part of management presentations that focus on particular business functions, operations or strategies and presents the steps taken by management to mitigate or eliminate such risks. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could adversely affect our business, data or information systems that we use or own.


text: Our Vice President of Information Technology, as head of our information technology team, leading our cybersecurity efforts, oversees the day-to-day administration of our cybersecurity program. Our CIRT has members that include our Chief Executive Officer, Chief Financial Officer, Vice President, Corporate & Securities Law, and Vice President of Information Technology. As key members of our management team, our Chief Executive Officer, Chief Financial Officer, and Vice President of Information Technology have approximately a combined 48 years of risk management experience and are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Key members of our information technology management team collectively possess over 16 years of hands-on experience in implementing a diverse array of cybersecurity initiatives. Their expertise spans both cloud and on-premise IT infrastructure and applications/systems, cultivated through extensive engagement across various regulated environments.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We have invested time and resources with a goal to define, implement and further develop the maturity of our cybersecurity risk management and strategy program. During this time, we have developed a common cybersecurity incident response plan across our businesses and jurisdictions that while unique to the risk profile of each business, allows us to utilize common response and decision-making protocols in an effort to react quickly to a potential cybersecurity threat and manage risk to our overall Company.

companyName: ATN International, Inc.

ticker: ATNI


text: In developing our cybersecurity incident response plan and assessing the maturity of our cybersecurity threat program, we utilize the National Institute of Standards and Technology Cybersecurity Framework (NIST). We use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We make it a practice to continually review the maturity of our program, utilizing the NIST standards and leveraging the feedback of both internal resources and external advisors in an effort to continuously improve our program in relation to evolving cybersecurity threats in our industry.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program overseen by our Risk Council, composed of professionals across a variety of departments and jurisdictions in our organization. Our cybersecurity program utilizes methodologies, reporting channels and governance processes across our subsidiaries that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that are assessed and reviewed when onboarding new vendors, customers, product lines or shifts in our service delivery models.


text: Our cybersecurity risk management program includes: risk assessments performed internally and with the help of third-party vendors that are designed to help identify material cybersecurity risks to our critical systems, information, products, services, equipment, and our broader enterprise IT and customer-facing network environments;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our response to cybersecurity incidents, and (4) our assessment of new products and business processes;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with the analysis of our security controls and those of our key vendors;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: To date, we have not experienced any prior cybersecurity incidents that have materially affected our operations, business strategy, results of operations, or financial condition. For a discussion of risks that could in the future impact our operations, business strategy or financial condition, please see " Cybersecurity breaches could have an adverse effect on our business " in our Risk Factors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity in connection with its general risk assessment and oversight. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives frequent, and typically no less than quarterly reports from management on our cybersecurity risks, assessment of our cybersecurity program, and development of our information security incident response plan. In addition, management updates the Committee, pursuant to an agreed upon timetable and escalation matrix regarding any material cybersecurity incidents, as well as providing the Committee with periodic reports on any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management from time to time on our cyber risk management program. Board members receive presentations and training on cybersecurity topics from our Chief Information Officer (CIO), Vice President of Security, or external experts as part of the Board's continuing education on topics that impact public companies. Our CTIO is an experienced information technology professional with just under 30 years of experience in the networking and communications industries. His extensive experience extends to all facets of information technology, including enterprise applications, cloud and SaaS systems, network infrastructure, and network management. For the past decade, he has been at the forefront of cloud systems development and security. Our VP of Security has over 30 years of experience in IT and Security and has the Certified Information System Security Professional (CISSP) certification as well as various technology vendor certifications.


text: As referenced above, our Risk Council is responsible for day-to-day cyber risk management, and reports to the Audit Committee on these matters. Our management team, including our General Counsel, who serves as the lead of our Risk Council, and our CIO are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our internal security team is made up of experienced professionals that have an average of more than 25 years of IT and security experience, including certifications such as CISSP, CompTia Security+. We also have developed an internal training program to develop new talent within our organization and work with vendor and third-party training programs to mentor and educate these team members to expand and enhance the capabilities of our team.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through various means, which may include briefings from internal security personnel; and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving our enterprise value. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. The Company's Information Security Officer is primarily responsible for developing, monitoring, and implementing our cybersecurity program, which establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Chief Technology Officer is responsible for implementing the appropriate controls and monitoring them towards adherence with the established standards.

companyName: First Foundation Inc.

ticker: FFWM