text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurance that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors—Risks Related to Our Business" of this Annual Report for more information regarding the cybersecurity risks we face.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: In addition, our management team, comprised of senior staff and executives from multiple departments within the Company, including IT, finance, legal, and operations, leads all efforts for our overall cybersecurity risk management program and supervises both our internal information security personnel and our retained cybersecurity consultants.

stage1Category: Management Role

stage1Method: majority


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Lovesac Co

ticker: LOVE


text: The Company is committed to protecting its information system and data from cyber threats. As part of our ongoing efforts to enhance our cybersecurity posture, we conduct an annual review of our information technology control environment and engages third-party security experts to conduct risk and vulnerability assessments including penetration testing. We additionally utilize third party technical tools to control system access and filter, restrict and regulate content that may pose a material risk to the Company. Employees are required to use multi-factor authentication to access Company systems and undergo annual security training. Management is responsible for identifying, monitoring and mitigating the material risks facing the Company, including cybersecurity risks. Management provides regular reports to the Board at every meeting to review our top risks, identify trends and help manage risk.

stage1Category: Risk Management Process


text: Our cybersecurity risk management and strategy is overseen by our Chief Information Officer as well as other members of the senior leadership team at Lovesac. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents and report to the Board on any appropriate items. Our Chief Information Officer has over 35 years of experience managing information technology and cybersecurity matters and is responsible for assessing and managing these cybersecurity risks. Team members who support our information security program have relevant educational and industry experience.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management and an area of focus for our Board and management. Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. The Board receives updates on a quarterly basis from senior management, including leaders from our Information Technology and Security, Risk Management. Finance, and Legal teams and our Chief Information Officer regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. The Audit Committee,of the Company's Board of Directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Board of Directors, as a whole and at the Audit Committee level, oversee the most significant risks facing the Company and our processes to identify, prioritize, assess, manage and mitigate those risks.


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risk. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: TILLY'S, INC.

ticker: TLYS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating and Corporate Governance Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer and/or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Chief Information Officer is responsible for assessing and managing our material risks from cybersecurity threats. He has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Risk Management and Strategy The Company maintains processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks and data, including its intellectual property and confidential information. The Company also uses the services of a third-party managed information technology company to provide cybersecurity software, monitor certain of our endpoints, infrastructure, and networks for irregular activities, to assist in identifying, assessing, and managing material risks and to provide incident response services.

companyName: 4Front Ventures Corp.


text: As of the date of this Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.

stage1Category: Strategy Integration


text: The Company's board of directors is responsible for oversight of management, who is responsible for overseeing the Company's risk management processes, including cybersecurity risks. The Company's board of directors recognizes the critical importance of maintaining effective cybersecurity measures and management's role in assessing and managing material risks from cybersecurity threats. The Company's managements provides the board of directors with timely updates both on a periodic basis and as new cybersecurity risks arise.


text: Cybersecurity Risk Management and Strategy We understand the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Cybersecurity processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated into our operations as a part of our overall risk assessment process.

companyName: Ocugen, Inc.

ticker: OCGN


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party cybersecurity firm to assist with aspects of our cybersecurity program including, but not limited to, network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.


text: Our processes also include assessing cybersecurity risks associated with our use of third-party services providers in the normal course of business use. We assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.

companyName: PEDEVCO CORP

ticker: PED


text: There have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Our internal computer systems or those of our development collaborators, third-party CDMOs, or other contractors or consultants may fail or suffer cybersecurity or other security breaches, which could result in a material disruption of our product development programs and cause our business and operations to suffer. We face risks related to our collection and use of data, which could result in investigations, inquiries, litigation, fines, legislative and regulatory action, and negative press about our privacy and data protection practices", for additional discussion about cybersecurity-related risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes. The Company's Associate Vice President of IT & Facilities is responsible for overseeing the cybersecurity risk management program. He has over 20 years of IT management, cybersecurity, and information governance experience. In order to monitor and appropriately escalate cybersecurity risks, our Associate Vice President of IT & Facilities receives reports on a monthly basis, and more frequently as appropriate, from our third-party cybersecurity vendor.


text: Our Board of Directors' role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks both at the Board and Committee level. The Board conducts its risk oversight by receiving reports from each of the Committees and our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats. The Company's Associate Vice President of IT & Facilities briefs the Audit Committee on the Company's cybersecurity risk management program on an approximately quarterly basis, using risk assessment reports from our third-party cybersecurity vendor. The briefing includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.


text: We have implemented procedures for assessing, identifying, and managing significant risks from cybersecurity threats and have incorporated these procedures into our overall risk management systems and processes. Our Board of Directors regularly evaluates significant risks from cybersecurity attacks, including any potential unauthorized occurrence on or conducted through our information systems that may adversely affect the confidentiality, integrity, or availability of our information systems or any information stored there. The program to manage cybersecurity risks has tools and activities designed to identify, examine, and manage current and potential cybersecurity threats, as well as plans and strategies to deal with threats and incidents.

companyName: Global Clean Energy Holdings, Inc.


text: We use these risk assessments to design, implement, and maintain appropriate safeguards intended to mitigate identified risks, address any shortcomings in our existing safeguards, and regularly check how well our safeguards work. Our information technology ("IT") department is primarily responsible for evaluating, overseeing, and handling our cybersecurity risks to manage the risk assessment and mitigation process.


text: Our IT department and Company management work in close collaboration to check and improve our safeguards as part of our overall risk management program. This collaborative effort extends to our employees, whom we regularly train on these safeguards and keep informed of our cybersecurity policies through regular communications across the Company. This collective commitment to cybersecurity ensures that everyone in the organization is aware of their role in maintaining our security.


text: When appropriate, we work with consultants or other third parties as part of our risk assessment processes. These partnerships are used to create and execute cybersecurity policies and procedures, including the notification of potential incidents. We ask key third-party service providers to confirm that they apply and keep appropriate cybersecurity measures in line with all relevant laws, to apply and keep reasonable cybersecurity measures when they work with us, and to promptly report any possible breach of their cybersecurity measures that could impact our Company.

stage1Category: Third-Party Risk


text: We have not identified risks from known cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors".


text: The Company maintains a cybersecurity and risk management program called the Information Security Management Program ("ISMP") designed to identify, assess, manage, mitigate and respond to cybersecurity threats and attacks. The ISMP is overseen by the Company's Chief Compliance and Privacy Officer, who oversees the Company's information technology security team as it relates to the ISMP and is responsible for assessing and managing the ISMP, informs senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Company.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: The ISMP is developed by the Company's information security team in collaboration with cross functional stakeholders, and is designed to ensure the organization's security posture and practices are in alignment with contractual, regulatory and industry requirements. Risk assessments against agreed criteria are conducted no less than annually, and sooner if there are significant changes in the environment. Security services are delivered through a combination of internal and third party resources. Formal periodic meetings are held with Company's executive leadership to review relevant components of the ISMP, formal annual reviews of the policies are conducted, formal reviews of the entire ISMP and risk register are conducted at least annually, and more frequently if there are significant changes to the environment. Also, an independent review of the ISMP is conducted in the following ways: (i) an annual HIPAA risk assessment conducted by a third party; and (ii) a HITRUST risk based two year assessment conducted by a third party.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of the Company's cybersecurity risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Company's Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.


text: We have, from time to time, experienced threats to and breaches of our data and systems, including breaches of our data within third party vendor's system. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition as of December 31, 2023. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, security breaches, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A of this report.


text: Cybersecurity Risk Management and Strategy As a global company, we are regularly subject to cyberattacks and other cybersecurity incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by our Chief Security Officer ("CSO"), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. We are also participants and subscribers in industry cybersecurity intelligence and risk sharing organization to stay abreast of changes in the cybersecurity environment.

companyName: Digital Media Solutions, Inc.


text: We assess the Company's Information Security program using an industry cybersecurity framework from the National Institute of Standards and Technology. This program includes policies, processes and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: We maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and periodic risk interviews across our business. We also engage an independent third party to perform internal and external penetration testing of the Company's information security environment periodically and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers, as well as third-party security firms used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, and threat intelligence to better inform the Company during contracting and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), the Company has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.


text: We maintain business continuity and disaster recovery plans to prepare for and respond to the potential for a disruption in the technology we rely on.


text: The Company (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to our Business," in Item 1A, "Risk Factors" in this Annual Report.


text: Cybersecurity Governance Our cybersecurity risk management and strategy processes are led by our CSO. This individual has over 25 years of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Although cybersecurity risk oversight continues to remain a top priority for the Board, the Audit Committee of our Board has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee quarterly reviews and discusses with our CSO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: These processes include internal and external vulnerability management systems, security grading systems, scanning systems, firewalls and breach alert systems, among others. Such systems and processes are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. As part of our risk management process, we conduct monthly vulnerability scans, annual penetration testing, phishing tests, annual risk assessments, and ad-hoc application security assessments. We also maintain a variety of playbooks for our incident response plan that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity and compliance training at least annually.


text: In addition, we engage certain third-party security providers to assist with assessing, identifying, and managing cybersecurity risks. Such services include but are not limited to managed security providers, assessors, consultants, auditors, and penetration testers. We also use a third party vendor management software to assess the security posture of other material third party vendors to reduce the impact of a security incident from such vendors. As discussed below, we rely on notifications from third-parties and other external alert systems to identify material risks that may exist with such parties.


text: Our cybersecurity team is led by our chief information security officer, who is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior management and other teams across the Company. The chief information security officer provides regular updates to the Cybersecurity Committee (discussed further below) of which he is also a member. Our chief information security officer has extensive cybersecurity knowledge and skills gained from over 19 years of experience at the Company as chief information security officer and chief information officer where he has been responsible for implementing and maintaining cybersecurity and data protection practices, implementing complex technology solutions, and managing large groups of technology professionals. He holds multiple cybersecurity industry focused certifications and reports directly to the Co-Chief Executive Officer.


text: The Audit Committee receives periodic reports from management, including our CTO and VP, IT. These reports encompass a broad range of topics, such as our cybersecurity risks, the current cybersecurity landscape and the status of ongoing cybersecurity initiatives. Furthermore, management informs the Audit Committee as deemed necessary, about any notable cybersecurity incidents.

companyName: Childrens Place, Inc.

ticker: PLCE


text: Cybersecurity incidents come to the attention of the Company from the cybersecurity team which may be notified of such incidents from internal vulnerability monitoring systems, third-party vendors, government or industry alerts, media broadcasts, or employee self-reporting. Risk assessment and mitigation efforts related to cybersecurity incidents are subject to oversight by the Cybersecurity Committee, which monitors the prevention, detection, and remediation of such incidents. The Cybersecurity Committee, which is comprised of directors from different divisions within the Company, as well as members of the cybersecurity team and the chief information security officer, oversees Company policies and procedures for protecting cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Cybersecurity Committee meets at least quarterly or whenever a material cybersecurity incident is identified at the Company. Material cybersecurity incidents, as well as mitigation efforts related to such incidents, are promptly reported to senior management.


text: Our cybersecurity risks and associated mitigation efforts are continuously monitored and evaluated by senior management as part of the Company's overall risk management process. In addition, a report prepared by the chief information security officer outlining any material cyber risks as well as any mitigation efforts is presented by the chief information security officer to the Audit Committee of our Board of Directors on a quarterly basis as part of the Company's enterprise risk assessment.


text: On April 5, 2024, Targus discovered that a threat actor gained unauthorized access to certain of Targus' file systems. Upon discovery and with assistance from external cybersecurity counsel and consultants, Targus immediately activated its incident response and business continuity protocols to investigate, contain, and remediate the incident. Through this process, proactive containment measures to disrupt unauthorized access resulted in a temporary interruption in the business operations of the Targus network. The incident has been contained and Targus systems recovery efforts are in process. While the investigation is ongoing and the incident has temporarily disrupted Targus' business operations, as of the date of this filing, the Company does not currently believe that this incident will materially impact the Company's financial condition or results of operations taken as a whole. Business operations for each of the Company's other subsidiaries have continued without disruption in all material respects, and no other Company business has been affected. Targus' systems are not shared with or connected to the systems of other Company businesses and no other Company business has been affected. Targus has notified relevant regulatory authorities and will work with law enforcement with respect to the unauthorized access to information.

stage1Category: Incident Disclosure


text: The Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Risks Related to Data Security and Intellectual Property," which should be read in conjunction with the information above.


text: Cybersecurity is an important part of our risk management program for our Board of Directors and management. Our Board of Directors, through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee, comprised solely of independent directors, is charged with overseeing the Company's risk management program, including cybersecurity matters.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: The Company also maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through internal management and external service providers. Our cybersecurity risk management and strategy processes are led by our Chief Administrative Officer. This individual has over 30 years of prior work experience in various roles involving managing information systems and security, developing information security strategy, implementing effective information and cybersecurity programs, as well as a degree focusing on computer science. The Chief Administrative Officer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management and participation in the Company's cyber security risk management and strategy processes including the operation of our incident response plan. This management team member routinely discusses trends in cyber risks and our strategy with management and reports to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. Our information security program includes, among other aspects, antivirus and malware protection, encryption and access control, and employee training. Risks identified by the Chief Administrative Officer and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The Chief Administrative Officer also periodically discusses trends in cyber risks and our strategy with our Audit Committee and management.


text: In addition, we engage independent third-party cybersecurity providers for testing and vulnerability detection. We regularly engage with these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and provide security awareness trainings and supplemental trainings as needed.


text: Incident Response and Recovery Planning: Our comprehensive incident response and recovery plans are designed to manage the aftermath of cybersecurity incidents. Regular testing and evaluation of these plans ensure preparedness and resilience.

companyName: WIDEPOINT CORP

ticker: WYY


text: Cybersecurity Risk Management At Katapult, cybersecurity risk management is an integral part of our overall enterprise risk management program and information security protocols. Our cybersecurity risk management program is based on industry best practices and CIS Critical Security Controls for handling cybersecurity threats and incidents, including threats and incidents associated with the use of internally developed applications and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees throughout the year.

companyName: Katapult Holdings, Inc.

ticker: KPLT


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee of the board of directors. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee also reports material cybersecurity risks to our full board of directors. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Technology Officer, or CTO, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO and dedicated personnel are certified and experienced information systems security professionals and information security managers with over 15 years of experience and are certified information systems security professionals. Management, including the CTO and our cybersecurity team, regularly update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity, learning and training activities and updates to the company's cybersecurity programs and mitigation strategies.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors —Risks Relating to Our Technology and Our Platform" in this annual report on Form 10-K.

stage1Category: None/Other


text: Our cybersecurity program includes the assessment, identification and management of material risks from cybersecurity threats (as defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, our annual enterprise risk management assessment considers risks from cybersecurity threats alongside other risks as part of our overall risk assessment process. In addition, we engage with consultants, internal and external auditors and other third parties to gather certain insights designed to identify and assess material risks from cybersecurity threats, their severity and potential mitigations. We also employ a range of tools and services, depending on the environment, including network and endpoint monitoring, malware detection, vulnerability assessments, cloud penetration testing, threat hunting and incident responsiveness, as well as tabletop exercises, to inform our cybersecurity risk identification and assessment. As part of our cybersecurity program, we maintain an incident response plan that includes processes to assess the severity of, escalate, contain, investigate and remediate cybersecurity incidents. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Aircastle LTD

ticker: AYR


text: Our Board of Directors has delegated oversight of our cybersecurity program, which includes oversight of cybersecurity threats, to the Risk and Governance Committee. Throughout the year, at each quarterly Risk and Governance Committee meeting, or as needed, the committee is updated on IT security by senior management, including industry IT breaches, cybersecurity incidents and employee cybersecurity training. Our Head of Information Technology is a Certified Information Systems Security Professional and is responsible for day-to-day assessment and management of our information systems and cybersecurity program. Our Head of Information Technology reports directly to our Chief Financial Officer.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and, we believe, are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional description of risks from cybersecurity threats and potential related impacts on the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "We are dependent upon information technology systems, which are subject to disruption, damage, failure and risks associated with implementation and integration."


text: To date, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. For a description of the risks from cybersecurity threats that may materially affect NetScout and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Risk Management and Strategy We consider cybersecurity and privacy to be important issues affecting the enterprise both in terms of reputational risk and economic risk. To effectively assess, identify, and manage material risks from cybersecurity threats, we maintain a cybersecurity risk management program, which is led by our Chief Technology, Logistics & Stores Officer ("CTO") and our Vice President, Information Security & IT Risk ("VP, IT"), as a part of the Company's overall risk management and compliance programs. To keep pace with ever-evolving threats and industry best practices, we have made, and will continue to make, sizable investments in building and developing cybersecurity talent and expertise and implementing state-of-the-art systems and tools, to detect, identify, classify and mitigate cybersecurity and other data privacy risks within our environment. We employ benchmarking to understand best practices and industry trends. We conduct security and compliance assessments throughout each year to validate the efficacy of our programs and practices. We also engage an independent third party expert to assess our cybersecurity maturity periodically against the retail industry. The results of these assessments inform our cybersecurity development roadmap going forward and are presented to the Audit Committee and the Board of Directors. We also maintain cybersecurity insurance as part of our comprehensive insurance portfolio.


text: We believe that we employ appropriate standards, guidelines and best practices to manage cybersecurity-related risk and have implemented comprehensive controls consistent with the requirements of the International Organization for Standardization ("ISO") and assess our cybersecurity maturity levels against the National Institute of Standards and Technology ("NIST") framework, including, but not limited to, the following: • Intrusion prevention controls (such as network segmentation and firewalls); • Access controls (such as identity and access management and multi-factor authentication on critical applications and systems); • Detection controls (such as endpoint threat detection and response, and logging and monitoring involving the use of a third-party for security information and event management, with reports and alerts provided by the third-party to the CTO's team); and • Threat protection controls (such as mandatory cyber-threat training and simulated phishing campaigns with employees, vendor management programs, and vulnerability and patch management).


text: In an effort to ensure that our associates are knowledgeable about our data security and protection policies, and to enable them to proficiently handle the threat of cyber-attacks, all associates are required to participate in a cybersecurity awareness training program annually. Financial, IT and other associates who have access to sensitive information are also required to attend additional training courses during the year. We also conduct frequent phishing simulations throughout the year to test our employees' responses to suspicious emails and to better inform our cyber awareness training program.


text: We circulate cyber awareness materials on a periodic basis on our intranet and hold a "Cyber Awareness Month" each year to promote the importance of cybersecurity topics. In addition, members of senior management participate in periodic crisis management exercises with third-party experts on crisis management best practices to apply their learnings to the Company's business continuity management program. In particular, in Fiscal 2023, the table-top exercise that was conducted for senior management focused on the handling of a cyber-security incident.


text: Because we are aware of the risks associated with third-party service providers, we also have implemented processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to help ensure compliance with our cybersecurity standards. In addition, we perform periodic risk assessments of key vendors. This approach is designed to mitigate risks related to potential data breaches or other security incidents originating from or at third-party service providers.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. As of Fiscal 2023, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For more information about the Company's assessment of cybersecurity risks, see the risk factor titled "A privacy breach, through a cybersecurity incident or otherwise, or failure to comply with privacy laws could have a material adverse effect on our business" in Part I, Item 1A, "Risk Factors".


text: We are committed to maintaining the trust we have established with our customers and associates. They expect that we will protect their personal information. Our comprehensive privacy program includes standards and practices focused on keeping data we collect secure and reflects our commitment to respecting privacy rights. Our Privacy Policy is available on our website and we continually assess and update this Policy to reflect industry best practices and applicable laws and regulations.


text: Our Board of Directors recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, as well as non-public information about our Company. Although the Board of Directors as a whole is ultimately responsible for the oversight of our risk management function, the Board of Directors uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for our cybersecurity risk identification and mitigation activities, and that Committee and senior management provide reports regularly to the Board of Directors.


text: Our management team, including our CTO and VP, IT, is responsible for assessing and managing our material risks from cybersecurity threats. The VP, IT's team has primary responsibility for the day-to-day operation and implementation of our overall cybersecurity risk management program and supervises both our internal cybersecurity team and our retained external cybersecurity consultants. The VP, IT's team also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our CTO's background includes more than 20 years of experience in the technology domain, with 15 years in the retail industry, leading e-commerce implementations and large scale transformation projects like adopting cybersecurity best practices. Our VP, IT has more than 30 years of experience implementing security in complex manufacturing and retail environments. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.


text: The Company's management maintains and implements a written Cyber Security Incident Response Policy and Cyber Security Incident Response Plan, both of which are reviewed and updated on a periodic basis. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, the Audit Committee, our Board of Directors, other stakeholders and law enforcement when responding to such issues.


text: The Company has implemented and maintained various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, lab equipment, software, and critical data includes confidential, personal, proprietary, and sensitive data. Accordingly, the Company maintains certain risk assessment processes intended to identify cybersecurity threats, determines the likelihood of occurring, and assesses potential material impact to the Company's business. Based on the Company's assessment, the Company implements and maintains risk management processes designed to protect the confidentiality, integrity, and availability of its information assets and mitigate harm to its business. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the Center for Internet Security (CIS), the National Institute of Standards and Technology (NIST) and other applicable industry standards and are integrated into the Company's overall risk management system and processes.

companyName: CUTERA INC


text: The Company engages in processes designed to identify such threats by, among other things, monitoring the threat environment, conducting scans of the threat environment, evaluating the Company's industry's risk profile, evaluating threats reported to the Company, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities.


text: The Company has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risk Factors - Security breaches, cyber-security incidents and other disruptions could compromise the Company's information and impact the Company's business, financial condition or results of operations." Governance.


text: The Board of Directors is responsible for oversight of the Company's risk management process. The Board administers this oversight function directly through the Board of Directors as a whole, as well as through the Audit Committee of the board. Areas of focus include economic risk, operational risk, financial risk (accounting, investment or liquidity, and tax), competitive risk, legal and regulatory risk, cybersecurity risk and compliance and reputational risks. The Board of Directors is supported by regular reporting by leaders from the Company's finance, cyber security, privacy, legal and compliance teams, who have an average of approximately 15 years of experience, which is designed to give the Board of Directors visibility over the Company's operations and activities to adequately identify key risks and understand management's risk mitigation strategies.


text: Risk management and strategy NetScout has implemented and maintains information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information, and the information of our customers and employees ("Information Systems and Data").


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: Digital Turbine, Inc.

ticker: APPS


text: Our Cybersecurity Executive Council ("Council"), which is led by the Chief Information Officer ("CIO") and includes our Chief Information Security Officer ("CISO"), Chief Operating Officer ("COO"), General Counsel ("GC"), Chief Compliance Officer ("CCO"), SVP of Research & Development, Senior Director of Engineering, and AVP of Engineering, oversees NetScout's cybersecurity program, including strategy, threats, risks, and mitigations. The CISO and Senior Director of Engineering, with guidance from the Council, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and NetScout's risk profile using various methods such as implementing manual and automated tools, subscribing to services that identify cybersecurity threats, analyzing reports of certain threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, conducting audits and threat assessments, conducting vulnerability assessments to identify vulnerabilities, and engaging in tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, among other things: an incident response plan, vulnerability management, systems monitoring, disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls for certain systems; data segregation and access controls for certain systems; physical security measures; asset management; employee training; certain testing; and IT and software development lifecycle training. NetScout also employs certain proprietary detection tools, enabling enhanced visibility and warning systems in response to certain cybersecurity threats.


text: We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and certain testing firms.


text: We use third-party service providers to perform a variety of other functions throughout our business, such as application providers, hosting companies, and supply chain resources (such as shipping). We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve risk assessments, data privacy and security questionnaires, assessments, and imposition of cybersecurity-related contractual obligations on the vendor.


text: Our risk-based assessment and management of material risks from cybersecurity threats are integrated into NetScout's overall risk management processes. Cybersecurity risks are addressed as a component of NetScout's enterprise risk management program and our enterprise risk management processes include an Enterprise Risk Management Steering Committee ("Steering Committee"), led by the CCO and including members of management, that meets quarterly and considers ways to mitigate cybersecurity threats that are more likely to lead to a material impact to our business. The Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and provides a risk register report to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: Our Board of Directors addresses NetScout's cybersecurity risk management as part of its oversight function. The Board of Directors' Audit Committee is responsible for overseeing NetScout's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our Council, in turn, oversees management's cybersecurity efforts.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of NetScout's management, including our CISO, who reports to the CIO and has over 25 years of experience, the CCO, and the Senior Director of Engineering for security.


text: The CISO and Senior Director of Engineering are each responsible for helping to integrate cybersecurity risk considerations into NetScout's overall risk management strategy and communicating key priorities to relevant personnel. The CISO and Senior Director of Engineering are also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy and plan are designed to escalate certain cybersecurity incidents to a Security Incident Response Team ("SIRT"), comprised of the CIO, CISO, GC, CCO and Senior Director of Engineering. The SIRT works with NetScout's incident response team to help NetScout mitigate and remediate cybersecurity incidents of which they are notified. In addition, NetScout's incident response plan includes reporting to the CEO and Chair of the Audit Committee of the Board of Directors for certain cybersecurity incidents. NetScout's Cybersecurity Disclosure Committee, which includes the SIRT and the CFO, assess the materiality of cybersecurity incidents for potential disclosure requirements according to an escalation process defined in NetScout's Cybersecurity Protocol for Disclosure Controls and Procedures.


text: The Board of Directors receives quarterly reports from the CISO and CIO concerning NetScout's significant cybersecurity threats and risk and the processes NetScout has implemented to address them. The Board of Directors also receives various reports, summaries and presentations related to cybersecurity strategy, threats, risk and mitigation.


text: Risk Management and Strategy Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal information security program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: a.we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO);

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: b.we maintain a dedicated cybersecurity team under the direction of our Chief Technology Officer (CTO) and supported by our Chief Information Security Officer (CISO), each of whom has expertise related to data and network security, data governance and risk management; c.we regularly test our internal IT controls; d.we regularly conduct internal vulnerability assessments as well as third-party penetration tests;


text: e.we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; f.we conduct pre-engagement and recurring reviews of the security controls and security-compliance posture of applicable third-party service providers; g.all employees are required to complete periodic trainings that cover security and privacy best practices and company policies;


text: h.we have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents; and i.we perform periodic simulations of attack scenarios by an internal "Red Team" to test the efficacy of both security controls and our tactical incident response procedures.


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our information security program, including our auditors, independent assessors (for example, for penetration testing) of our cybersecurity program, internal and external legal counsel, and other consultants.


text: We have a documented incident monitoring, escalation and reporting process and procedure that we believe to be effective in detecting and analyzing cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: a.continual monitoring of our systems and logs by both dedicated cybersecurity internal and outsourced staff;


text: b.immediate escalation to and review by our CISO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments;


text: c.if deemed appropriate, reporting by our CISO to the Company's Management and its Disclosure Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and d.informing the Audit Committee of our Board of Directors (the "Board") of significant or material cybersecurity incidents, as appropriate.


text: All incidents are documented and recorded and catalogued for further review by the CISO and their team. Incidents that are deemed to be significant and/or rise to the level of a "security breach" are documented in a security incident register as part of our established vulnerability monitoring and incident response procedures.


text: We at Faraday Future employ a cybersecurity strategy for addressing cybersecurity risks, security vulnerabilities, and impacts that align with the NIST Cybersecurity Framework (CSF). The NIST Risk Management Framework (RMF) provides a comprehensive, flexible, and measurable process to manage information security and privacy risks for Faraday Future systems. This framework outlines standards and guidelines to support the implementation of risk management programs to meet the requirements of the Federal Information Security Modernization Act (FISMA). The NIST framework promotes the protection of Faraday Future infrastructure. We utilize the five core functions of the framework which are Identify, Protect, Detect, Respond, and Recover.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Risk management and strategy Nextracker places emphasis on addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risks.

companyName: Nextpower Inc.

ticker: NXT


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. We have faced—and in the future may face—sophisticated attacks, including attacks referred to as advanced persistent threats, which are cyberattacks aimed at compromising our intellectual property and other commercially sensitive information, such as the source code and game assets for our software or confidential customer or employee information, which may remain undetected for prolonged periods of time. In September 2022, we experienced a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from Rockstar Games' systems, including early development footage for the next Grand Theft Auto. Subsequently, also in September 2022, an unauthorized third party illegally accessed credentials for a vendor platform that 2K Games uses to provide help desk support to its customers. The unauthorized party sent a communication to certain players containing a malicious link. 2K Games immediately notified all affected users and took steps to restrict further unauthorized activity until service was restored. In connection with this activity, we have incurred certain immaterial incremental one-time costs related to consultants, experts and data recovery efforts and we generally expect to incur additional costs related to cybersecurity protections in the future.


text: In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, reputational harm, and loss of investor confidence. See Item 1A, Risk Factors, for more information on the cybersecurity threats facing our Company.


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including, through the Audit Committee, cybersecurity and information security risk management and controls. As part of its oversight function, the Board, directly and through its Audit Committee, oversees the Company's risk assessment and risk management policies, including related to cybersecurity. At least semi-annually (with respect to the Audit Committee) and annually (with respect to the Board), our CTO and CISO report to the Audit Committee or the Board addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CTO and CISO have primary responsibility for managing our information security program and efforts, including with respect to cybersecurity. They work closely with key stakeholders, including internal committees such as our Cyber Steering Group, peer institutions, and industry groups, in order to manage cybersecurity and information security risk. Our internal audit team is responsible for testing and auditing our information-technology internal controls. In addition, leaders from our communications, finance, legal and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency.


text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and relevant training and certifications, such as Certified Information Systems Security Professional (CISSP) certification, ISO 27001 certification, and other technical cybersecurity certifications from ISC2, the SANs Institute and OffSec as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.


text: Cybersecurity Risk Management and Strategy The Container Store has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on a hybrid security framework model using the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Payment Card Industry Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and PCI DSS as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Container Store Group, Inc.


text: We have an enterprise risk management program designed to identify and assess enterprise risks. At certain committee and Board meetings periodically throughout the year, management discusses the risk exposures identified as being most significant to the Company and the related actions that management may take to monitor such exposures. Our cybersecurity risk management program is integrated into our enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program.


text: Management is responsible for the operational oversight of the company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.

companyName: Momentus Inc.

ticker: MNTS


text: Our cybersecurity risk management program currently includes the following key elements, which are deployed as the Company deems applicable: • We conduct periodic risk assessments, as well as internal and external vulnerability scanning and penetration testing of select systems and platforms, which are designed to help identify material risks from cybersecurity threats to our critical systems and information. • We have established security procedures for day-to-day operations designed to promote optimal system performance and maintain the integrity of critical systems and information, including detection, prevention and recovery controls, as well as backup procedures designed to prevent the loss of critical data, among other practices. • Our policy is to train employees and relevant contractors on cybersecurity awareness. The Company's office-based associates, store-based associates and certain distribution and fulfillment center associates are required to undergo security awareness training at the time of hiring. The Company's store-based associates may also receive ad hoc cybersecurity awareness communications and materials as part of their store's local operations training. • We have established, and periodically test, data security breach preparedness and response plans that are designed to address a range of scenarios that include data breaches and ransomware attacks. • We are subject to regular information technology and security audits by internal audit staff and external third parties. • We conduct third-party cybersecurity risk diligence for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: The Company (or a third party on which it relies) may not be able to fully, continuously and effectively implement security controls as designed or intended. The Company utilizes a risk-based approach and judgment to determine which security controls to implement, and it is possible that the Company may not implement appropriate controls if management does not recognize, or underestimates, a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Security events, when detected by security tools or third parties, may not always be immediately understood or acted upon by the Company (or by third parties on which it relies).


text: As of the filing of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have occurred that have materially affected us, including our business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. If as a result of any future attacks our information technology systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity breach, we may suffer an interruption in our ability to manage and operate the business, and our business strategy, results of operations or financial condition could be adversely affected. See "Risk Factors – Information Technology Risks."


text: The Audit Committee (Committee) of our Board of Directors has primary oversight responsibility for the Company's risk assessment and risk management activities, including addressing risks related to cybersecurity through policies and processes, and considering any recommendations for improvement of relevant controls. The chairperson of the Audit Committee updates the full Board of Directors on these matters as deemed appropriate.


text: The Company has a Cybersecurity Council, which is composed of representatives of the Company's senior management and exercises management-level oversight of cybersecurity matters. Our Chief Information Security Officer ("CISO") has primary responsibility for the development, operation, and maintenance of the Company's cybersecurity risk management program. The CISO holds multiple cybersecurity certifications and has approximately 15 years of cybersecurity experience with public retail companies.


text: The Committee receives reports from the CISO at least twice per year regarding our cybersecurity risk management program and cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding internal and external security reviews, risk assessments, breach preparedness, threat assessments, and cybersecurity incidents it considers to be significant.


text: Personnel with access to certain Company data and information technology assets are required to promptly report known or suspected security incidents. Our incident response process is designed to facilitate the reporting of cybersecurity incidents to management, including the CISO and the Company's designated internal legal counsel, as well as other identified associates from across the Company's business, as applicable.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our Information technology security team has a working relationship with our third-party vendors such as Rapid7, Carbon Black and Cisco to provide guidance related to the management of cybersecurity risks. Our strategy includes both short- and long-term projects to increase the security surrounding our assets by using threat monitoring, threat detection, and SIEM tools within our security systems. We perform cybersecurity assessments with respect to asset scanning, risk assessments, and vulnerability scans with respect to users in our organization and third parties who provide critical services or who have access to critical confidential data.


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Our critical business systems are fully redundant and backed up. Our security systems correlate security events from our SIEM and aggregate security-related incident data, such as malware activity, malicious activities, and ransomware. Security functionality is continuously monitored by our IT security team and our third party comanaged vendor soc team, and our network traffic is analyzed for signs of malicious activity through the Cyber security systems. Anti-virus solutions are deployed throughout our organization on servers, laptops and workstations in our data centers, headquarters, and remote sites.


text: We have hired an independent third-party cybersecurity firm to perform penetration testing annually. The third-party checks for vulnerabilities on our external and internal network perimeters. If vulnerabilities are found, corrective actions are implemented to remediate any issues.


text: Our employees are required to take annual cyber security training designed to help employees guard our cyber and physical data. Employees are tested on this training.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. This cybersecurity risk management process includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access and other security incidents and vulnerabilities.


text: As part of our cybersecurity risk management process, we conduct regular application security assessments, vulnerability management, external penetration testing, security audits, and risk assessments. We leverage third-party security service providers to provide continuous and uninterrupted identification and mitigation of risk-prioritized security events. We maintain an incident response plan that is utilized when incidents are detected. Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond, recover from and mitigate cybersecurity incidents, which include processes to assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational harm.


text: We require employees with access to information systems, including all corporate employees, to undertake data protection, cybersecurity, privacy and compliance programs at least annually. We maintain a team of dedicated security and compliance professionals who oversee cybersecurity risk management, mitigation, incident prevention, detection, and remediation, which is led by our Chief Information Security Officer ("CISO"). The team has deep cybersecurity experience with an average tenure of over 20 years with expertise in protecting critical assets for top firms in a myriad of different industries.


text: We leverage SOC 2 Type 2 attestation framework to determine the operating effectiveness of our internal security controls and use NIST Cybersecurity framework to better understand, manage and reduce cybersecurity risk and protect our business from ever-changing cyber threats.


text: As part of our cybersecurity risk management process, we contractually require third-party service providers to implement and maintain key security measures in connection with their work with us when appropriate that is consistent with applicable laws. Additionally, our third-party service providers are to promptly report any breach of their security measures or systems that may affect our Company. Our security and compliance professionals track and log privacy and security incidents across our vendors and other third-party service providers to remediate and resolve any such incidents. Significant incidents associated with our vendors and service providers are reviewed regularly to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management.


text: Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company.


text: The Audit Committee has oversight responsibility over our cybersecurity risk management process, including risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration.


text: Senior management regularly discusses on at least a quarterly basis and otherwise as needed, cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls such as the CIS 18 Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-term member of both ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.


text: At Nextracker, we maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate established best practices and industry standards, drawing guidance from both CIS 18 and NIST CSF. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors. 1.Information Security Assessments: We collaborate with internal and external partners to evaluate our security. 2.Vulnerability Scanning and Penetration Testing: Engaging third-party service providers to assess external and internal vulnerabilities and potential threats. 3.Cyber Risk Register Reviews: Regularly review our internal risk register to stay vigilant against potential and identified risks. 4.Risk Prioritization: We prioritize and address risks through our dedicated cybersecurity risk management program and the cybersecurity council.


text: We monitor the threat environment for potential risks, employing various methods, including automated detection tools, environment scans, and investigations of potential threats and reports. We also use threat intelligence feeds and vulnerability databases to monitor our systems, and have incident response processes designed to ensure swift action.


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed. For more detailed information about our company's specific cybersecurity risks, please refer to the risk factor titled "Cybersecurity or other data security incidents could harm our business, expose us to liability and cause reputational damage" in Item IA. Risk Factors of this Form 10-K.


text: Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee of our Board of Directors. The Audit Committee of our Board of Directors is responsible for reviewing internal risk assessments with respect to cybersecurity, including assessments of the overall threat landscape and related strategies and investments.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Security Leader. Our Security Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation. The Audit Committee also reports to our Board of Directors on cybersecurity matters as needed.


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT controls, governance, risk and compliance reviews.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Data breaches or incidents involving our technology could damage our business, reputation and brand and substantially harm our business and results of operations." in Item 1A, "Risk Factors" of Part I of this report.


text: Our Audit Committee is responsible for overseeing cybersecurity risks and updates our Board of Directors on cybersecurity matters as needed. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified as promptly as practicable of significant new cybersecurity threats or incidents.


text: Risk Management and Mitigation Strategies As part of our commitment to safeguarding our assets and maintaining the integrity of our operations, C3 AI has established a comprehensive cybersecurity risk management program. This program is designed to identify, assess, and mitigate cybersecurity risks that could potentially impact our business operations, customers, and stakeholders. C3 AI employs a multi-layered approach to identify and assess cybersecurity threats. This includes: • Regular vulnerability scanning: We conduct internal and external vulnerability scans of our systems and applications to identify potential weaknesses that attackers could exploit. • Penetration testing: We engage independent security professionals to conduct simulated cyberattacks on our systems to assess the effectiveness of our security controls. • Threat intelligence monitoring: We subscribe to threat intelligence feeds that provide us with real-time information about the latest cyber threats and vulnerabilities. • Risk assessment framework: We utilize a risk assessment framework to categorize identified threats based on likelihood and potential impact on our business operations, financial stability, and reputation. This framework includes third-party vendor risk assessment to manage cybersecurity risks associated with our use of these providers. The third-party vendor risk assessment framework includes the following: Perform due diligence of the vendors' standards, including reviewing security policies, certifications, and third-party attestation and past security incidents. Request vendors to complete security questionnaires and provide any security and vulnerability scans.

companyName: C3.ai, Inc.

ticker: AI


text: Define security expectations within the vendor contract including data security obligations, access controls, incident reporting procedures, security assessment calls if necessary and review of incident response plan, business continuity and disaster recovery plan.


text: • Network security: Firewalls, intrusion detection/prevention systems (IDS/IPS), and data loss prevention (DLP) solutions are deployed to monitor and filter network traffic. • Endpoint security: Antivirus, anti-malware, and Mobile Device Management solutions are implemented on all company devices. • Access controls: User access controls are implemented to restrict access to sensitive data and systems based on the principle of least privilege. • Data security: Encryption solutions are used to protect sensitive data both at rest and in transit. • Security awareness and training: We provide regular security awareness training to all employees to educate them on cybersecurity best practices and phishing attempts.


text: For a description of the risks from cybersecurity threats that may materially affect us, see the section titled "Risk Factors" contained in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity risk management is integrated with our overall enterprise risk management framework. Identified cybersecurity risks are reported through established channels to relevant stakeholders, including senior management and the Board of Directors. Mitigation strategies are prioritized and incorporated into the overall risk management plan. We continuously identify and evaluate potential cybersecurity threats. While the nature of cyber threats makes it impossible to predict all future incidents, some currently identified material cybersecurity risks include: • Ransomware attacks that could disrupt business operations and lead to data breaches. • Phishing attacks that could compromise employee credentials and provide unauthorized access to sensitive data. • Supply chain attacks targeting third-party vendors with access to our systems or data.


text: Management is responsible for the overall implementation and effectiveness of the cybersecurity program. This includes allocating resources, establishing policies, and ensuring employee adherence to security practices. The VP of Information Security leads the cybersecurity team and reports directly to the VP of Cloud Infrastructure.


text: The Audit Committee of the Board of Directors has specific oversight responsibilities related to cybersecurity, including review of security controls and incident response plans. Management provides updates to the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program.


text: Our commitment to security is evidenced by our certifications under ISO 27001, ISO 27017, SOC 2 Type II, HIPAA, NIST 800-171 and FedRamp Additionally, we subject our standards-based certifications to annual audits by third parties and have successfully undergone examinations such as the Health Insurance Portability and Accountability Act (HIPAA), validated by qualified third-party assessors. There were no material cybersecurity incidents experienced by C3 AI during the fiscal year ended April 30, 2024.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IDEANOMICS, INC.

ticker: IDEXQ


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our VP of IT, software and telematics who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: We engaged consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Chief Executive Officer. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.