text: The Company has a firewall that protects the whole network, including intrusion protection, virus protection and other subscription-based protection that updates regularly. For those with remote access there is end-to-end encryption with a secure VPN to access the server. All computers, including those in office and any remote user's computers have an antivirus software from a company that specializes in cybersecurity that has been installed and maintained by an outside IT consultant. The software is updating and reviewing any cyber threats on a continual basis. Additional services provide email filters to minimize phishing and spam emails. Employees are trained to not open suspicious emails and to never open attachments unless they are expecting an attachment from that Company or individual.


text: Sensitive files are password protected and accessible by only select individuals. These files are maintained on a separate drive. Computer files are backed up and redundancy protocols are in place so that minimal downtime would occur in the event of a cyber breach. The Company also maintains cyber insurance coverage to ensure that the Company is adequately prepared in the event of an unforeseen cyber incident.

companyName: BAB, INC.

ticker: BABB

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: No system is entirely immune to cyber threats and although our risk is low, the impact of a cybersecurity incident could impact our business, cause reputational harm, subject us to increased operating costs and/or expose us to litigation. To date, we have had no cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact our operations or financial condition. Should an incident occur, the CFO and/or DFO will immediately report the incident to the Audit Committee with all details. The communication will identify what steps are currently being taken to resolve the incident, and what actions are being taken to prevent any further security incidents from occurring.

stage1Category: Strategy Integration


text: Risk Management, Strategy, and Governance Our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes are led by a dedicated, outsourced Chief Information Officer, in collaboration with outside cybersecurity partners, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Qualified third-party service providers are tasked with developing, implementing, and executing that strategy. These third parties play a key role in our cybersecurity risk assessment and management processes, as we rely on their cybersecurity experience and expertise to assess, identify, and manage emerging trends and risks from cybersecurity threats on an ongoing basis.

companyName: Laird Superfood, Inc.

ticker: LSF

stage1Method: majority


text: Our Chief Executive Officer and other members of our senior management, as appropriate, provide oversight and monitoring of these third parties, who provide regular reports to management. Management provides periodic reports to our Board as a whole, who are ultimately responsible for the oversight of risks from cybersecurity threats, which include updates on the Company's cyber risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape, and any recommendations for additional internal controls, systems, or insurance coverage for board approval.

stage1Category: Board Governance


text: Our cybersecurity policies are focused on ensuring the security and protection of our systems, networks, and proprietary data, which includes trade secrets, intellectual property, corporate strategic plans, marketing plans, material non-public financial information, and personally identifiable information, such as employee and customer information. We also actively engage with key vendors as part of our continuing efforts to actively monitor system access, identify and quarantine potential cybersecurity threats, to assess and implement cybersecurity systems and tools, and to enhance the effectiveness of our information security policies and procedures.


text: Cybersecurity risk management processes are one component of our overall risk assessment process whereby, on an ongoing basis, we analyze our internal control environment and consider how threats to the business might circumvent those controls. These processes include control over and segregation of user access to key systems, monitoring of any user access anomalies, active monitoring of emerging trends in the broader market, timely identification and quarantine of any potential cybersecurity incidents, evaluation of our operations and business needs and how executing on those needs translates to potential threats, and training of end users to mitigate the likelihood of user error.


text: We assess materiality of cybersecurity incidents based on the type of breach, whether any information was accessed, the nature of the information accessed, and the potential for business interruption. As of the date of this report, we are not aware of any material incidents from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: With the guidance of a qualified third -party that reports to and regularly meets with the Chief Executive Officer, we continue to make improvements in our cybersecurity program throughout our operating companies. We have established processes, consistent with nationally recognized frameworks, for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. Our prevention efforts are multi-faceted, and are intended to address threats to our employees, networks, applications and data.

companyName: CRAWFORD UNITED Corp


text: Our third -party advisor has performed cybersecurity risk assessments of our information technology security processes and implemented technologies to lessen risk and respond to new risks as they arise. Using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across our networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we require employees to participate in ongoing training and testing programs through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Any potential cybersecurity incident discovered is promptly reported to the Chief Executive Officer and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns with management (including data privacy risk management) and the steps management has taken to monitor and control such exposures.


text: There have been no cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A. Risk Factors — "A significant disruption in, or breach in security of, our information technology systems or data could adversely affect our business, reputation and results of operations."


text: Risk Management and Strategy We strive to implement leading data protection standards to ensure a strong commitment to cybersecurity. Our Data Security Policy and Cybersecurity Incident Response Plan ("CIRP"), which is part of our enterprise wide risk management processes, guides our cybersecurity program. The CIRP, developed in consultation with an independent cybersecurity expert, includes processes for identifying, managing, and remediating cybersecurity incidents. We utilized the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") guidelines to develop and implement the CIRP, which is approved by our Chief Technology Officer ("CTO"). However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we used the NIST and CIS as a guide to help create develop and implement the CIRP. The CIRP is reviewed and updated annually. The Company's cybersecurity risk management processes include ongoing monitoring and testing of its information systems and data to identify and respond to potential cybersecurity threats. Internally, the Company utilizes an enterprise Attack Surface Management tool to routinely scan for vulnerabilities to internal assets. Externally, we use third-party vendors to routinely conduct scans for vulnerabilities to external assets. In addition, our internal auditors along with management also conduct periodic monitoring of our internal controls over our data security and customer privacy systems and processes.

companyName: GRAY MEDIA, INC

ticker: GTN


text: The cybersecurity incident response process is governed by our incident response plan and overseen by leaders from our IT security and legal teams.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Although we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or have been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats and incidents we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A. "Risk Factors".


text: Management is responsible for the Company's day-to-day risk management and the Board serves in an oversight role. The Board has empowered the Audit Committee with formal oversight of enterprise risk matters, including with respect to cybersecurity. The Audit Committee and management periodically review the Company's policies with respect to risk identification, assessment, and management, including cybersecurity risk exposures and the internal controls and procedures in place to manage such risks, as well as the steps that management takes to monitor and control such exposures. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues.


text: The Cybersecurity Incident Response Team ("CIRT"), which is led by the CTO, is responsible for the prevention, detection, mitigation, and remediation of cybersecurity incidents and conducts primary incident response efforts. Our CTO, who is responsible for assessing and managing the Company's cybersecurity risks, has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at Raycom Media prior to the Raycom Merger. Other team members of the CIRT also have relevant educational and industry experience, including holding similar positions at large companies. Incidents can be escalated up to our executive leadership team, depending on the severity of the incidents. Our President and/or CTO regularly report to our Board, and our CISO and General Counsel regularly report to our Audit Committee about our cybersecurity health and initiatives. In addition, the Board receives quarterly reports on risk management activities across Gray operations, including with respect to cybersecurity.


text: We believe that cybersecurity is a critical part of our overall risk management profile, which is supported by both our management and our Board of Directors. We believe that we face the same external threats common to other participants in the infrastructure sectors, which include ransomware and malware attacks in addition to the risks brought on through the vendor supply chain. Through the leadership of our Vice President of Information Technology, who reports to our Chief Financial Officer, we continuously assess these threats and evaluate our landscape for new vulnerabilities, considering both for their probability of occurrence as well as their perceived potential impact. We supplement our risk assessment processes with robust third-party identification tools which we review routinely through the use of intrusion prevention and detection systems. We supplement our internal procedures with third parties, who routinely assess our network infrastructure for vulnerabilities both internal and external to our firewall. We also conduct periodic training and awareness programs for all of our employees with systems access in order to drive adoption and awareness of their critical roles in cybersecurity processes and controls.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: The pace of change in approaches undertaken by cyber criminals requires that we strive for continuous improvement and constant monitoring of the broader landscape. In 2024 we adopted the cybersecurity framework of the National Institute of Standards and Technology ("NIST"), and worked to assess our adoption of the NIST cybersecurity framework against a group of peers. We believe that continued evaluation by external experts is the best means to ensure both the design and operational effectiveness of our cybersecurity policies, internal controls, and standards. Furthermore, these periodic reviews are critical to evaluate that we have the right people, technology, and processes to identify, prevent, and detect the activities of bad actors who desire to challenge the system continuity and functionality of the information technology we depend on to operate our business. In addition to our prevention efforts, we also prepare for criminal infiltration through the evaluation of our incident response plan including table top exercises, which helps us assess our ability to react timely and effectively to various degrees of cybersecurity incidents. We believe our plan is well-designed and capable to manage an unforeseen breach including the eradication of the infiltrator from our networks. We carry cyber insurance to transfer the residual risk of an incident. We also work with our cyber insurance carrier to regularly refine our response procedures, which include the definition of internal and external communications channels to key stakeholders, as well as the identification of material breaches and the associated incident reporting up to senior management and our Board of Directors.


text: Our Board of Directors has charged the Audit Committee with the governance and oversight of this risk. Our committee charter requires quarterly reporting to our Audit Committee by our Vice President of Information Technology covering key cybersecurity accomplishments, planned enhancement activities, and monitoring observations of the threat environment. Board experience in risk assessment has been enhanced with certification achievements specific to cybersecurity risk, providing us with the appropriate oversight for this evolving threat.


text: The CISO and CIO are informed about and monitor these cybersecurity programs and incidents through their oversight of, and participation in, the cybersecurity risk management and strategy processes described above, including management of and notices from our Security Operations Centers and the supervision of our incident response plan and processes.

companyName: TIDEWATER INC

ticker: TDW


text: As of the date of this report, we are not aware of any material breaches to our networks or computer systems that have materially affected or are reasonably likely to materially affect our execution of our business strategy, results of operations, or financial condition. We describe potential risks from cybersecurity threats under the heading "Our information technology systems can be negatively affected by cybersecurity threats," in Part I — Item 1. "Risk Factors" of this 2024 Form 10 K, which disclosures are incorporated herein by reference.


text: Cybersecurity Risk Management & Strategy Our business requires the use of information technology (IT) and operational technology (OT) resources, including those to carry out our day-to-day operational activities both onshore and offshore, to maintain our business records and to proactively monitor internal and external cybersecurity threats. To respond to cybersecurity risks and threats, we have developed a cybersecurity risk management program designed to identify, assess, manage and respond to cybersecurity incidents while also preserving the confidentiality, integrity and continued availability of our information and assets. The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001 Information Security Management System Requirements.


text: We have a Security Operations Center operating in multiple regions that provides daily monitoring of our global cybersecurity environment and coordinates real-time investigation and remediation of alerts. Identifying and assessing cybersecurity risks related to our business, operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT/OT security, governance, risk and compliance reviews. To deter, detect and respond to cybersecurity incidents, we conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and consultants, and conduct tabletop exercises to simulate responses to cybersecurity incidents. We also conduct and require our workforce to complete ongoing cybersecurity awareness education and training. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.


text: We have implemented incident response and breach management processes, including (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident; (iii) containment, remediation and recovery from an incident; and (iv) post-incident analysis. Such cybersecurity incident responses are overseen by leaders from our IT, compliance and legal teams as further described under "Cybersecurity Governance" below, and elevated to other senior leaders, third party providers and the Audit Committee of the Board as appropriate and in accordance with our response plan and procedures.


text: We engage third party security experts for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. We use the findings of these exercises to improve our practices, procedures, and technologies. We engage third party security experts to support our cybersecurity threat and incident response management and maintain cybersecurity risk insurance coverage.


text: Our risk management program also assesses third party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business or customer data.

stage1Category: Third-Party Risk


text: We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company. For more information on our cybersecurity risks, see "Risk Factors – Risks Relating to Information Technology and Cybersecurity – Cybersecurity attacks on any of our facilities, or those of third parties, may result in potential liability or reputational damage or otherwise adversely affect our business."


text: Cybersecurity Governance The Audit Committee of our Board oversees our cybersecurity risk management program and meets on a quarterly basis with our Chief Information Officer (CIO) to review our cybersecurity programs and risks, including (as applicable) assessments and program maturity; evolving cyber risks; status on addressing and/or mitigating cyber risks; any recent cybersecurity or data privacy incidents at the Company and across the industry; and status on any key cybersecurity initiatives. These cybersecurity risks and programs are further reviewed and considered by the Board in connection with the company's overarching enterprise risk program.


text: Our cybersecurity team is led by our Director of IT Infrastructure, who has over 20 years of experience and obtained various professional security certifications and advanced training in the field of cybersecurity and technology and reports to our CIO. Our CISO is responsible for managing and supervising our cyber risk management program and informing the CIO and senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

stage1Category: Management Role


text: Our cybersecurity program takes a cyberthreat and risk-based approach and was developed to align with ISO 27001, an international standard for information security, and we also assess ourselves against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition, our cybersecurity risk management program aligns with ISO 31000, the international standard for risk management. The foregoing does not imply that we meet all technical standards, specifications or requirements, or that we have been certified on these requirements in any respect, only that we have used these industry standards as guides when designing our cybersecurity and risk management programs.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. For example, cybersecurity threats are subject to our firm-wide Risk Events Policy, which sets forth procedures for the identification, escalation, recording, investigation and approval of handling of such risk events.


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. Major incidents emanating from cybersecurity threats are communicated to our Operational Risk team through our enterprise risk management system and escalated in accordance with our incident response plan. In addition, cybersecurity has been designated as a principal risk by the Risk Committee of our Board of Directors (the "Risk Committee"), which requires regular monitoring and reporting.


text: We identify material risks from cybersecurity threats through various sources, including, but not limited to, controls testing, compliance testing of our security standards, independent penetration testing, open-source threat intelligence feeds, and lessons learned and assessments against control frameworks. These threats are assessed by applying our Risk and Control Self-Assessment ("RCSA"), information technology risk and cybersecurity risk management processes, each of which we review regularly. Based on the RCSA, risks from cybersecurity threats that exceed established risk tolerance thresholds are recorded and incorporated into our reporting to the Risk Committee and senior management as described in more detail below. We also engage third -party assessors, consultants and auditors to assist in the administration, assessment and improvement of our cybersecurity risk management program.


text: To help bring risks from cybersecurity threats within an acceptable risk appetite and tolerance level, we created a cybersecurity strategy and associated program of necessary activities. The program mitigates the risks through the effective design and implementation of compensating controls or remediation actions, commensurate with the assessed risk level from such threats.


text: With respect to third -party service providers with access to our information systems, assets or data, our security policies, standards and procedures are designed so that periodic due diligence is conducted as appropriate on the cybersecurity controls maintained by such third parties. The aim is to ensure the third -party service provider has adequate and appropriate cybersecurity measures in place commensurate to the risk their access to our information systems, assets or data presents.


text: We have not identified any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the business strategy, results of operations or financial condition of the Company. Please refer to the risk factor captioned "We could be subject to losses and reputational harm if we, or our agents, fail to properly safeguard sensitive and confidential information against cyberattacks or other security breaches or if our business processes are not sufficiently resilient." in Part I, Item 1A. Risk Factors, for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors has established a Risk Committee to assist the Board in its oversight of risk. As part of its responsibilities, the Risk Committee oversees management's implementation of our cybersecurity and risk management program.


text: The Risk Committee receives regular reports from our Information Security leadership on our cybersecurity risks, including key status updates, security issues, current and future priorities, independent assurance, threat landscape and audit findings. The Risk Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity oversight.


text: Our Information Security team, including our Information Security leadership, has primary responsibility for identifying, assessing and managing material risks to the Company from cybersecurity threats, including our overall cybersecurity risk management program and supervision of our internal cybersecurity personnel and our external cybersecurity consultants. Our Chief Information Security Officer ("CISO") has over 20 years of information security/cybersecurity experience, working in a variety of roles within PricewaterhouseCoopers LLP, as the Director of Cyber Operations for Nationwide Building Society, the CISO at The Crown Estate and the CISO at Insight Investment.


text: maintain multiple layers of controls, including embedding security into our technology investments, multi-factor authentication tools, apply policy of least privilege to data and systems access, monitor logins both at network perimeter and within, segment and firewall system access within the network perimeter not solely at network edge or perimeter;

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Our Information Security leadership regularly briefs our Global Chief Operating Officer and Chief Technology Officer on cybersecurity issues, the scope of which is similar to the information presented by the Information Security leadership to the Risk Committee as described above. Major risks from cybersecurity threats determined following application of an RCSA are escalated by our Information Security leadership to the Risk Committee, Global Chief Operating Officer, Chief Technology Officer and other senior management.


text: Cybersecurity Risk Management and Strategy We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is intended to make cybersecurity considerations an integral part of our decision-making processes. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a management team responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our Senior Director of Information Technology and Senior Vice President, Quality Assurance, who report to the Chief Financial Officer and Chief Executive Officer, respectively, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The Senior Director of Information Technology and Senior Vice President, Quality Assurance have primary responsibility for our overall cybersecurity risk management program and supervises both our internal technology and quality assurance compliance personnel and our retained external cybersecurity consultants. Our Senior Director of Information Technology has more than 20 years of experience in IT Management, including cybersecurity, and our Senior Vice President, Quality Assurance has more than 20 years of experience in computerized system and IT infrastructure controls, compliance, and risk management.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM") and is one of the key risks identified for oversight by the Board through our annual ERM assessment. Our ERM approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's information; and (iv) protect our IP. Vigilance: We maintain 24/7 cybersecurity threat operations designed to rapidly detect, contain and respond to cybersecurity threats and incidents.

companyName: CEVA INC

ticker: CEVA


text: Governance: Our board of directors' oversight of cybersecurity risk management is supported by our Chief Financial Officer and Compliance Officer, who interacts directly with, and is provided relevant information by, our cybersecurity team. While our board of directors has the ultimate oversight responsibility over the management of cybersecurity risk, our audit committee reviews the risk management process relating to cybersecurity on a regular basis.


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We periodically engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures. The assessments include information security maturity evaluations, independent environmental security control reviews, operating effectiveness and penetration testing. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our board periodically receives presentations and reports from the management team on information regarding the policies, processes and practices that we implement to address risks from cybersecurity threats including, for example, discussion of recent developments, evolving standards, third-party and independent reviews, the threat environment and technological trends. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, the board will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.


text: Our cybersecurity team is composed of the global head of Information Technology & Management Information Systems, the Chief Information Security Officer ("CISO") and deputy CISO. This cybersecurity team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our cybersecurity team members each possess 15-35 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training.


text: The cybersecurity team works collaboratively across the Company to implement customized programs designed to protect and respond to cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response plan. Chief concerns are reported to our broader management team when appropriate.


text: We have not previously experienced any material cybersecurity incidents. In addition, cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to affect, the Company, including our business strategy, results of operations, or financial condition.


text: At AvePoint, cybersecurity risk management is an important part of our overall risk management efforts. We have a policy of transparency regarding our data collection, use, retention and sharing practices, and it is our commitment to implement appropriate technical security measures to protect all AvePoint stakeholders and manage third party risk.

companyName: AvePoint, Inc.

ticker: AVPT


text: Our operations may, in some cases, involve the storage, transmission and other processing of customer data or information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer "hackers," malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of AI. We have experienced cyberattacks in the past, and although immaterial, there can be no guarantee that in the future such cyberattacks will not be material. We believe we are a particularly attractive target because of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, first- and third-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor. We have certified against, and demonstrated conformance to, the latest International Organization for Standardization's ("ISO") information security management system audit using the 27001:2022, 27701:2019, and 27017:2015 frameworks. Successfully achieving these three certifications demonstrates our prioritization of security and privacy for both us and our customers, and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations. Our three ISO certifications add to the company's overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC 2 Type II, compliance with HITRUST CSF v11.0.1., CSA STAR, IRAP and FedRAMP.


text: 33 Table of Contents Our privacy and security program dictates a governance structure whereby we: Regularly engage senior management on data privacy and security issues; Align policies, procedures, and technical controls to demonstrate our process and our commitment to our customers and users; Train each of our employees on all privacy and security expectations; Conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; Maintain a robust cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across AvePoint; Periodically run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; Maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; Monitor emerging data protection and cybersecurity laws, and implement changes to our processes, systems and offerings designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; Complete several cyber-specific audits per year; and Engage consultants and other third parties in connection with our cybersecurity practices.


text: Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity and privacy programs and the supporting control frameworks. These processes support informed risk-based decision-making and prioritization of cybersecurity countermeasures and risk mitigation strategies. Our risk mitigation strategies include a broad variety of technical and operational measures, as well as annual cybersecurity and privacy training for all of our employees.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel, threat intelligence and other information obtained from public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: In addition, we maintain specific policies and practices governing our third -party security risks, including our third -party risk assessment (" TPRA ") process. Under our TPRA process, we gather information from certain third parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to maintain security controls to protect our confidential information and data, and to notify us of material data breaches that may impact our data.


text: Our Chief Risk, Privacy and Information Security Officer (" CISO ") leads the company's privacy, data protection and security program. An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and has been a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100, featured in Forbes, and named a Top Global CISO by Cyber Defense Magazine. including being featured in the "CSO Hall of Fame".


text: In addition, our CISO oversees teams across the company supporting our security and privacy functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO reports directly to our Chief Executive Officer and is a member of the company's senior management team, and is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Additionally, our CISO and Chief Compliance Officer regularly update our senior leadership team, our Nominating and Corporate Governance Committee, and the full Board, on the company's privacy and cybersecurity program, including privacy and cybersecurity risks, incidents, and mitigation strategies.


text: Disclosure of the Board ' s Roles and Responsibilities Our Board oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles. Additionally, our CISO and Chief Compliance Officer regularly report on cybersecurity matters to the Board, as discussed above.


text: Nominating and Corporate Governance Committee Our Nominating and Corporate Governance Committee oversees risks associated with data privacy and information security, which encompasses cybersecurity. Our CISO and Chief Compliance Officer, among other executives, provide periodic reports to our Nominating and Corporate Governance Committee and also meet with our Nominating and Corporate Governance Committee to discuss any material events when they arise. The periodic reports are designed to keep our Nominating and Corporate Governance Committee abreast of the Company's cybersecurity practices, as well as risks and trends in cybersecurity threats. Our Nominating and Corporate Governance Committee also has discussions with management focused on evaluating our exposure to cybersecurity risks and cybersecurity practices in place to mitigate such risks. These discussions enable our Nominating and Corporate Governance Committee to be informed of the steps management is taking to detect, monitor and manage cybersecurity risks. These reports to our Nominating and Corporate Governance Committee typically include information on any incidents that have occurred, how they were managed, and any changes to the risk profile of the Company. Our Nominating and Corporate Governance Committee seeks these updates to facilitate proactive governance and to address emerging cybersecurity issues with management.


text: In 2024, we did not identify any privacy or cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10 -K.


text: Bel employs a full-time Cybersecurity Expert who reports directly into our Global Head of IT and Cybersecurity Services. During 2024, the Company worked with third-party cybersecurity specialists to continually enhance the programs Bel has in place. These relationships involve regular communication and collaboration between the Bel cybersecurity team and our third-party providers to share threat intelligence and implement proactive measures to safeguard our systems and data. The Company has continued to invest in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. Our cybersecurity team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. Further, we conduct periodic external penetration tests. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers that host our applications. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. Third-party contractors or vendors that require access to our network are given specific limited access to only the specific resource. The access provided expires automatically after a period determined by the project and must follow all Company security measures.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: The Audit Committee of the Board of Directors is responsible for overseeing the management of cybersecurity risks. The Audit Committee is informed about cybersecurity risks through quarterly reports from the Global Head of IT and Cybersecurity Services and, as necessary, to the full Board. The Audit Committee also reviews and approves the company's cybersecurity policies and the Company's Global Head of IT and Cybersecurity Services is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. This includes our overall information security strategy, policy, security engineering, operations and cyber incident detection and response reporting in alignment with Company policies. The current Global Head of IT and Cybersecurity Services has more than 16 years of information technology and program management experience which includes information security, and others on our IT security team have extensive cybersecurity experience and certifications.


text: The Company recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board of Directors, through the Information Technology Steering Committee (ITSC) and Compliance Risk Management Committee (CRMC), provides direction and oversight of the risk management framework of the Company including cybersecurity risks. The ITSC and CRMC establish policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: The Committees have the authority to conduct or authorize reviews into areas within its scope of responsibility, which is all items impacting information security. The Committees focus on the following: Promote effective information technology and information security governance.


text: Critically evaluate and assess the direction and progress of major IT-related projects, IT security decisions, IT priorities, and overall IT and IT security performance. Review and approve significant IT and information security related policies, including annual changes. Review and approve IT and information security risk assessments on an annual basis. Discuss activities and requirements pertaining to the Information Security Program.


text: Oversee requirements of the Bank's Vendor Management Policy, including processes for approving third -party providers including the financial condition, business resilience, and IT security position of third -parties. Ensure risk assessments and New Vendor Relationship Information is completed for all vendor relationships. Review and approve risk assessments for significant, critical vendor relationships on an annual basis. Examine the Bank's Business Continuity and Disaster Recovery Plan, including updates and testing. Provide for comprehensive, effective, and, if required, independent audit coverage of IT risks and controls.


text: Analyze all regulatory examination reports and internal and external audit reports impacting information technology as well as any required responses and/or updates. Assess the performance of the Committee and the Committee's role and responsibilities on an annual basis.


text: Identify, analyze, and determine strategic risk tolerance and/or mitigation direction for compliance risks identified as high and/or those with an increasing risk profile.


text: Review all regulatory examination reports impacting compliance and/or risk as well as any required responses The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board of Directors annually.


text: The Board of Directors, through the ITSC and CRMC, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board of Directors review and approve the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: The Chief Information Officer ("CIO") works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. The CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the ITSC and CRMC.


text: Management, including the CIO, regularly reviews with the Board of Directors the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides updates on notable developments in the cybersecurity threat landscape. Additionally, management follows a risk-based escalation process to notify the Board of Directors outside of the cycle of regular updates when an emerging risk or material issue is identified, such as a potentially significant cybersecurity threat or incident.


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG

stage1Category: None/Other


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third -party assessments, internal information technology audit, information technology security, governance, and risk and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and techniques to test security controls, conduct employee training, and monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Technology, Compliance, and Legal teams regarding matters of cybersecurity.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Our risk management program also assesses third -party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third -party cybersecurity incidents to identify and mitigate risks to us from third -party incidents. We also carry business interruption insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to board committees.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on us. Although we have not experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by cybersecurity strategies we have put in place. Despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, mitigate, and remediate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. For more information about the cybersecurity risks we face, see the risk factor entitled "We depend on the proper functioning and availability of our management information and communication systems and other information technology assets (including the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches internally or with third-parties, or an inability to effectively upgrade such systems and assets could cause a significant disruption to our business and have a materially adverse effect on our results of operations" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Technology, Compliance, and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Technology, Compliance, and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Cybersecurity Risk Management Program The Company's cybersecurity risk management program, aligned with the National Institute of Standards and Technology Cybersecurity Framework (CSF) domains and HITRUST CSF, is designed to employ industry best practices, including ongoing enhancement of governance, risk, and compliance management, regular updates to our response planning and protocols, security policy and standards maintenance, and new technology implementation to proactively monitor vulnerabilities and reduce risk, including processes designed to identify material cybersecurity risks associated with our use of third -party service providers. This program includes the engagement of consulting firms and other third parties.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: A key component of our cybersecurity risk management program is our incident response policy, which provides for evaluation, response, and reporting procedures in connection with a cybersecurity incident. Under this policy, we have established an incident response team (IRT), a multi-disciplinary management-level team led by the Company's Chief Technology Officer (CTO) and comprised of the Company's Chief Executive Officer (CEO), General Counsel/Compliance Officer, Chief Financial Officer, and EVP, Corporate Strategy. The policy provides that the IRT will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of the IRT. In such event, the policy provides that the IRT will assess whether a cybersecurity incident has the potential to materially impact the Company and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit Committee and/or the Board of Directors.


text: The Company maintains cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity matters. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. We do not believe that any risks we have identified to date, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we or the third parties with which we interact have not identified or experienced, or will not experience, a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A data breach or cybersecurity incident could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability, subject us to litigation and governmental inquiries and actions, damage our reputation, and otherwise adversely impact our financial results and business" included in Part I, Item 1A of this Form 10-K.


text: The Company's strategic approach to cybersecurity governance, characterized by our rigorous third-party assessments, industry certifications, and a clear organizational reporting structure, underscores our unwavering dedication to safeguarding sensitive information and maintaining trust.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Cybersecurity Governance The Company's cybersecurity risk management processes are integrated into the Company's overall risk management program. In this regard, our Board of Directors has designated the Audit Committee as being primarily responsible for overseeing risk management at a board level, and has delegated certain specific categories of risk oversight matters to the Audit Committee as well as to the other standing committees of the Board, within their respective areas of responsibilities. Additionally, the Audit Committee makes periodic reports to the Board regarding briefing and reports provided by management and advisors regarding various risk oversight matters as well as the Audit Committee's own analysis and conclusions regarding the adequacy of the Company's risk management program.


text: As part of its board-level risk oversight responsibilities, the Audit Committee provides oversight of the Company's privacy, data, cyber security, and information security risk exposures. Further, at a management level, the Company's cybersecurity risk management program is led by our CTO, who reports to the Company's CEO. Our CTO was appointed as the Company's senior vice president and chief technology officer in July 2017. Our CTO has expertise in cybersecurity risk management through his more than 20 years of experience in healthcare technology, including his service with us as well as his service as chief technology officer at other organizations prior to joining the Company in 2017. On a quarterly basis, the Company's CTO reports to the Audit Committee regarding the Company's cybersecurity program. The CTO also reports to the Audit Committee on a quarterly basis regarding remediation activities, if any, along with related security metrics, in connection with any areas where cybersecurity threats have been identified.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats to our business and operations and developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems. CoreCard's information technology network, infrastructure, and software systems, including integration points to third parties related to the FinTech services the Company offers, are critical to the Company's business and operations. The Company holds confidential, proprietary, and personal information about its customers, its customers' customers, employed or contracted personnel, and third-party vendors. In addition, the Company's business in the FinTech industry requires it to be compliant with Payment Card Industry (PCI) Data Security Standards and U.S. and foreign data and information security mandates specific to its operations and services. To address these items, CoreCard has developed a robust cybersecurity risk management program focused on identifying, assessing and managing cybersecurity risk. The program involves a dedicated team responsible for operational cybersecurity, and includes an internal IT Security Team, PCI Compliance Force, and Emergency Management Team, which together are responsible for developing and executing the Company's cybersecurity strategy and identifying and mitigating related risks.

companyName: CoreCard Corp

ticker: CCRD


text: The IT Security Team consists of five members, led by the VP of IT of the Company's CoreCard Software subsidiary, and focuses on the Company's overall data and cybersecurity. The PCI Compliance Force consists of six members, is led by the subsidiary's Chief Technology Officer, and focuses on the Company's compliance with PCI standards. Both teams hold regular meetings to discuss and report on, as applicable, meaningful cybersecurity risks, threats, incidents, and vulnerabilities, and changes in and compliance with industry data and cybersecurity standards. The teams also develop and oversee mitigation and remediation activities within their areas of responsibility. The teams, in conjunction with senior management, work to ensure that the Company is meeting requirements of applicable regulations and that the Company's third-party vendors are also meeting compliance requirements. The teams are also tasked with the development and maintenance of business continuity plans, security policies and procedures. The Company's Emergency Management Team, which consists of seven members and is led by the Company's Chief Executive Officer, has developed business incident response runbooks designed to guide operational staff with a set framework for response and mitigation to cybersecurity incidents and threats.


text: The Company has also designed its information technology systems and infrastructure to protect its and its customers' data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company's operation of cardholder data environments. The Company's cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting. This partnership enables us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current.


text: Our business is managed under the direction of our Board of Directors (the "Board"), which guides our long-term strategy and represents the highest level of oversight at the Company. Our full Board oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our Board views the identification and effective management of cybersecurity threats as a critical component of its overall risk management and oversight responsibilities. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board reviews and discusses these cyber risks and threats and provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.


text: The Information Security Policy contains numerous distinct administrative and technical controls that govern data security for the organization and is based on the NIST Cybersecurity Framework. The policy is reviewed and approved by the Board annually.

companyName: Investar Holding Corp

ticker: ISTR


text: The Company faces a number of cybersecurity risks in connection with its business. Based on the information the Company has as of the date of this Form 10-K, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. However, cybersecurity threats are constantly evolving, and many of the security measures that the Company has implemented must also evolve over time. While CoreCard seeks to utilize industry standard measures and tools to monitor and address these evolving threats, the Company may not be able to anticipate, prevent or mitigate its cybersecurity risks, the occurrence of which could result in significant legal and financial exposure, theft, damage to the Company's reputation, interruption of the Company's business operations, the loss of confidence in the Company's security measures, and harm to the Company's business.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cyber risk management program is integrated into our overall risk management system, which includes a cybersecurity risk assessment process, that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee as part of their involvement in managing and overseeing cybersecurity risks.


text: Key aspects of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: a security team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training for our employees, incident response personnel, and management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have established separate processes and procedures to oversee and identify cybersecurity risks associated with our use of third -party service providers. All third parties involved in our cybersecurity risk assessments and risk management are required to provide reports designed to allow us to monitor and assess such third parties' security controls.


text: As of the date of this report, though the Partnership and our service providers have experienced certain cybersecurity incidents, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite implementation of our cybersecurity process, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors – Our business is subject to cybersecurity risks" included elsewhere in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives, as necessary, briefings from management on our cybersecurity risk management program and receive presentations on cybersecurity topics from IT leadership, which includes our Chief Sustainability and Administrative Officer ("CSAO"), or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our cybersecurity team, led by the CSAO, is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Partnership stakeholders and external advisors. Our cybersecurity team includes the CSAO and IT leadership. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity team includes professionals with deep cybersecurity expertise across multiple industries. The CSAO has over 20 years of audit, risk management and cybersecurity experience covering the energy, pipeline, utilities, manufacturing, and financial services industries.


text: We rely on a series of processes to identify threats, hazards, and other risks to our assets. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. Our processes and practices are reviewed by audits, regulators, and independent reviews of information security and cybersecurity practices and processes carried out by professional services organizations retained by us against industry requirements, such as the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool. These frameworks also provide guidance that we leverage for overseeing and identifying cybersecurity threats associated with the use of third-party service providers. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis.


text: Our assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our Information Technology and Information Security teams meet weekly across several disciplines to ensure that risks are timely identified, patch and vulnerability requirements are monitored, and the necessary changes are implemented.


text: The Information Security and Information Technology teams support the business through early engagement in the Project Management Office routines and the Vendor Management Office's requirements, to ensure that new products, projects, and third -party vendors are onboarded with appropriate oversight.


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.


text: State regulators have also been increasingly active in implementing cybersecurity standards and regulations. Recently, several states, notably including California where our banking business is concentrated, have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states (including California) have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments in California where most of our clients are located.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our clients. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our Information Security Program is managed by a dedicated Chief Information Security Officer ("CISO"), who leads our Information Security team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CISO holds a BSc degree in the combined studies of Computer Science & History of Science from Herriot-Watt University and a graduate of the Carnegie Mellon University's Heinz College of Information Systems and Public Policy + Software Engineering Institute's Chief Risk Officer Executive Education and Certificate Program. He holds the following professional certifications from the Information Systems Audit and Control Association: Certified Information Systems Auditor (CISA), Certified in the Governance of Enterprise IT (CGEIT), and Certified in Risk and Information Systems Control (CRISC). Additionally, he has more than 20 years of experience in financial services, including management experience with Globally Systemically Important Banks, as well as experience in cybersecurity, information security & information technology risk management, governance, risk, and compliance.


text: part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: The CISO provides periodic reports to the executive risk management committee and the board-level risk committees of the Company and the Bank, as well as the cross-functional management steering committee that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation and remediation of cybersecurity incidents. Our CISO also provides reports to our Chief Executive Officer and other members of our senior management, as appropriate. The Chief Risk Officer and the board-level risk committees of the Company and the Bank report to the full board of directors on key cybersecurity risk management topics, as appropriate.


text: OPKO Health, Inc. ("OPKO" or the "Company") is committed to the highest standards of cybersecurity, adhering to the SEC's definitions for 'Cybersecurity Incident,' 'Cybersecurity Threat,' and 'Information Systems.' Our focus is on safeguarding our digital infrastructure and sensitive data against unauthorized access and threats.


text: Risk Management and Strategy Risk Assessment and Management: OPKO employs rigorous assessment and management of cybersecurity risks, aligning with NIST and other industry standards. Our strategy is integrated into our overall risk management program, reflecting our commitment to safeguarding data.


text: Collaborative Approach: We utilize a cross-functional strategy, involving key security, risk, and compliance stakeholders, to preserve data confidentiality and manage cybersecurity threats. Technical Safeguards: Regular assessments and updates of technical safeguards are based on ongoing vulnerability analyses and threat intelligence.


text: Incident Response and Recovery: We have established comprehensive incident response and recovery plans, ensuring readiness and effective response to cybersecurity incidents.


text: Third-Party Risk Management: Rigorous controls are in place to mitigate risks associated with third -party service providers, including security risk assessments and contractual security requirements.


text: Education and Awareness: Regular privacy and security training for employees is conducted to enhance awareness and response to cybersecurity threats.


text: External Assessments and Attestations, and Certifications: Annual vulnerability and penetration tests and data privacy and protection reviews are performed by third -party experts. No significant findings were identified. OPKO maintains industry certifications such as SOC 2 Type 2 and PCI DSS attestations.


text: No Material Breaches or Incidents: There have been no material breaches or cybersecurity issues affecting the Company. Consequently, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected, nor are they reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition. As of the date of this filing, the company maintains that its cybersecurity measures have been effective in mitigating potential risks associated with cybersecurity threats.


text: Board Oversight: The Audit Committee of the Board has direct oversight, regularly reviews reports on cybersecurity risks and vulnerabilities. The Audit Committee is informed about risk assessments, progress of risk reduction initiatives, and feedback from external auditors. Our chief compliance & audit officer ("CCO/CAO") and his direct report, chief information security officer ("CISO"), have primary responsibility for assessing and managing material cybersecurity risks. The CCO/CAO reports to the Audit Committee, which is the primary governing body that drives alignment on security decisions across the Company. The Audit Committee meets at least four times a year on cybersecurity and such meetings are attended by the CCO/CAO, CISO, in-house counsel, chief financial officer ("CFO"), corporate controller, associate general counsel, and other senior company executives as needed to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Audit Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation.


text: Expertise and Leadership: Our Chief Compliance & Audit Officer (CCO/CAO) possesses over 28 years of experience in Cyber Security and IT Controls across various complex organizations, including initial tenure at Boston University Medical Center, followed by roles at PricewaterhouseCoopers, Biogen, Vertex Pharmaceuticals, and currently OPKO Health for the past 7 years. The CCO/CAO has a master's degree in Computer Science with a specialization in Cyber Security from Boston University, a qualifying UK law degree from the University of Edinburgh, an MBA in Accounting, and a Master's of Finance from Northeastern University, in addition to a BA in Economics from Dartmouth College.


text: The CISO brings over 28 years of experience in Cyber Security and IT Controls, with the last 16 years serving as CISO of the Company and previously at Everest Insurance Corp. Prior experience includes several years at PricewaterhouseCoopers as an IT auditor and Cyber Security consultant. The CISO holds comprehensive Cyber Security accreditations and certifications, including CISSP, CISA, CRISC, CHP, CDRE, and MBCI, and has completed undergraduate degrees in Accounting and Computer Information Systems from Baruch College. The CISO oversees a department comprising five cyber security engineers with extensive experience.


text: Risk Management and Strategy Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer (the "CISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Senior Management Team ("SMT") and our Tech Oversight Committee. Our Tech Oversight Committee includes members of our Board and management. Our CISO has served in this capacity for more than a decade and maintains multiple certifications issued by the Information Systems Audit and Control Association ("ISACA") and the SANS Institute. As part of our overall enterprise risk management program, we maintain both an Information & Cyber Security Program Policy ("ICSPP") and Information & Cyber Security Incident Response Policy ("ICSIRP").

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Our ICSPP is overseen by the SMT, which is responsible for designating the CISO. The CISO is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The CISO is charged with all logical security related matters, which include but are not limited to, PC/server security, network security, internet security, and database and application security. Our ICSIRP is based on applicable federal and state laws as well as cybersecurity incident response best practices. The purpose of the ICSIRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident. These objectives include maximizing the effectiveness of our company's operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third -party contractors.


text: Our company has engaged a third -party managed detection and response company to monitor the security of our information systems around-the-clock, including intrusion detection and response, and to provide instantaneous alerting should a cybersecurity event occur. If a cybersecurity threat or cybersecurity incident is identified through our company's information systems, the CISO and Incident Response Team ("IRT") will take immediate steps to mitigate the threat and assess any damages. Upon report from the CISO, the SMT will evaluate the materiality of the cybersecurity threat or cybersecurity incident to determine if any public disclosures are required under the Security and Exchange Commission's cybersecurity disclosure rule. If deemed necessary, third -party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.


text: Our company has training and awareness programs designed to educate its employees about cybersecurity risks and how to protect our company, our customers and themselves from cyber-attacks and to keep its employees informed about cybersecurity threats and how to stay safe online, including secure access practice, phishing schemes, remote work and response to suspicious activities.


text: Our cybersecurity program interfaces with other functional areas within our company, including but not limited to, our company's business segments and information technology, legal, risk, human resources and internal audit departments, as well as external third -party partners, to identify and understand potential cybersecurity threats. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we also engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable our company to leverage specialized knowledge and insights, ensuring its cybersecurity strategies and processes remain at the forefront of industry best practices. Our company's collaboration with these third parties includes regular audits, testing, threat assessments and consultation on security enhancements.