text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee. The Company's IT department regularly uses specialist firms to independently test our cybersecurity controls. The IT management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with security personnel, threat intelligence and other information obtained from government, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Currently, we have not identified risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.

companyName: TSS, Inc.

ticker: TSSI

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: Our Board of Directors (Board) oversees the management of the risks inherent in the operation of the Company's business, principally through the Governance Committee. Our Governance Committee oversees our risk management efforts, with cybersecurity being an element of our comprehensive Enterprise Risk Management (ERM) strategy. Our executive officers report information to the Board through the Governance Committee regarding the risks that impact the organization, including cybersecurity risks, and any material events.

companyName: WIDEPOINT CORP

ticker: WYY


text: NIST SP 800-34, Rev 1, "Contingency Planning Guide for Federal Information Systems," November 2010 NIST SP 800-37 Rev. 2, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," December 2018 NIST SP 800-53, Rev. 5, "Security and Privacy Controls for Information Systems and Organizations," September 20, 2020, updated December 10, 2020 NIST SP 800-61, Rev 2, "Computer Security Incident Handling Guide," August 2012 Our approach to cybersecurity aims to protect the confidentiality, integrity, and availability of the data we handle. This process involves measures to identify and prevent cybersecurity threats and mechanisms to mitigate and respond to cybersecurity incidents.

stage1Category: Risk Management Process


text: Risk Management and Strategy Our cybersecurity program, a pivotal component of our overarching ERM framework, concentrates on several key areas:


text: Collaborative Approach: We employ a holistic, cross-functional strategy to identify, prevent, and mitigate cybersecurity threats. Our approach includes rapid escalation protocols for specific cybersecurity incidents, enabling timely decision-making on public disclosure and reporting by management.


text: Technical Safeguards: We utilize advanced technical safeguards to defend our information systems. These include firewalls, intrusion prevention and detection systems, anti-malware tools, and stringent access controls. Continuous vulnerability assessments and leveraging cybersecurity threat intelligence ensure these safeguards remain practical and up to date.


text: Education and Awareness: We understand the importance of informed personnel, so we conduct mandatory, regular training on cybersecurity threats. This training aims to equip our staff with the necessary tools to confront these threats effectively and disseminate updates on WidePoint's evolving information security policies, standards, processes, and practices.


text: We are committed to maintaining robust cybersecurity defenses through regularly evaluating and improving our policies, standards, processes, and practices. This commitment is actualized through a diverse array of assessment and testing activities, which include: Comprehensive Audits and Assessments: We conduct audits and assessments to scrutinize the efficacy of our cybersecurity measures.


text: Tabletop Exercises and Threat Modeling: Engaging in tabletop exercises and threat modeling allows us to simulate and prepare for potential cybersecurity scenarios, ensuring readiness and adaptability. Vulnerability Testing: Vulnerability testing is performed to proactively identify and address potential security weaknesses.


text: External Evaluations: We regularly commission third parties to conduct in-depth assessments to ensure an unbiased and comprehensive evaluation. These include information security maturity assessments, audits, and independent reviews of our information security control environment and its operational effectiveness.


text: Based on the insights gleaned from these assessments, audits, and reviews, we dynamically adjust and refine our cybersecurity policies, standards, processes, and practices to continuously enhance our cybersecurity posture.


text: By engaging in these rigorous and diverse testing and assessment activities, we verify the current effectiveness of our cybersecurity measures and identify areas for continual improvement, ensuring our defenses evolve in line with the dynamic nature of cyber threats.


text: Executive Experience and Qualifications Our CEO has over thirty (30) years of risk management experience, and our COO with over twenty (20) years of experience including cybersecurity, possess deep expertise in their respective fields, evidenced by their academic qualifications and professional trajectories. This collective experience underpins our robust approach to managing cybersecurity risks. In addition, we have numerous employees with experience and qualifications related to cybersecurity. We have named a Chief Information Security Officer as part our cybersecurity program. Our executive officers are responsible for informing the Board and Governance Committee of any new material cyber events or risks.

stage1Category: Management Role

stage1Method: majority


text: Cybersecurity Threats are discussed in ITEM 1 A. RISK FACTORS, under the heading RISKS RELATED TO PRIVACY, CYBERSECURITY AND TECHNOLOGY in this Annual Report on Form 10-K. We are not aware of any material cybersecurity incidents in the past that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Fyntechnical Innovations Inc

ticker: FYNN


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors, since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support table top exercises and to conduct security testing.


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.


text: Cybersecurity Risk Management and Strategy. We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. Certain of these systems are managed, hosted, provided or used by third parties, to assist in conducting our business and which have their own cyber security measures in place. We implement generally applicable industry standards and best practices processes for the assessment, identification, and management of material risks from cybersecurity threats to our information technology systems. Our Information Security Coordinator oversees our information security policies and procedures. Our Information Security Coordinator maintains a cyber incident reporting and response process and provides management notifications based on the seriousness of any incident. Our information security policies and procedures are required to be reviewed on a regular basis.

companyName: Onfolio Holdings, Inc

ticker: ONFO


text: We have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect our Company and how they may do so, please see "Risk Factors - Risks Related to Information Technology Systems, Intellectual Property and Privacy Laws" included in Part I, Item 1A of this Annual Report on Form 10-K. If our security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being unsecure, which could harm our business and reputation, and our proprietary business information could be misappropriated which could have an adverse effect on our business and results of operations."


text: Cybersecurity Governance. Our Nominating and Corporate Governance Committee has primary responsibility for overseeing our risk-management program relating to cybersecurity, although our Board of Directors participates in periodic reviews and discussion dedicated to cyber risks, threats, and protections.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks, and resiliency against incidents. Our cybersecurity risk management processes include accessing security controls, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We engage a third-party information security officer who maintains, monitors, and ensures the security of our digital assets. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products. We maintain security programs that include physical and technical safeguards. We monitor cybersecurity vulnerabilities and potential attacks, and we evaluate the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. We continue to integrate our cyber practices into our enterprise risk management practices, which is overseen by our Board of Directors. In addition, we assess the risks from cybersecurity threats, periodically engage third-party tools to assist us in enhancing and monitoring our cybersecurity risks, primarily spam and suspicious email filters, and regularly back up company information.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: We have experienced cybersecurity incidents, primarily related to phishing emails, and may in the future experience, whether directly or indirectly, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations, or financial condition, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations, or financial condition. See risks related to cybersecurity and business disruptions in "Risk Factors" in this Form 10-K.


text: Our Board of Directors is responsible for risk oversight. Our chief executive officer and chief financial officer, with input from and potentially attendance by our third-party information security officer, provide presentations to the Board of Directors on cybersecurity risks or threats as necessary. In the event of a potentially material cybersecurity event, the Chairman of the Board is notified and briefed, and a meeting of the full Board of Directors would be held, as appropriate.


text: Management and the Company's third-party information security officer discuss information technology needs and activity and assess and manage material cybersecurity risks and the Company's practices for the prevention, detection, mitigation, and remediation of cybersecurity incidents, as necessary and appropriate. Our third-party information security officer has 30 years of experience in the IT management field and has consulted with large and mid-size corporations on proper IT processes and security. Our CEO and CFO have managed information technology departments during their careers. Our CFO was trained as an auditor and an information technology auditor at the public accounting firm of Ernst & Young LLP and audited the internal controls, including IT controls, of public companies, information technology departments, and third-party information technology service providers for 12 years.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity program is designed to protect its assets and information, and to maintain the secure storage and of proprietary information relating to our customers, employees, applicants, vendors, and other parties, including financial information and personal information. The Company's cybersecurity program is formed using a risk-based approach with recommendations from cybersecurity consultants, cybersecurity insurers, and other third-party consultants.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Our cybersecurity program includes, among others: a cybersecurity education program with on-going employee activities, which include frequent phishing simulation and testing and annual training; access management and access controls with periodic reviews;


text: Our Board of Directors has overall responsibility for risk oversight and oversees the implementation and continuous improvement of our cybersecurity program and compliance with disclosure requirements. The Board of Directors receives regular reports and periodic briefings from the Chief Executive Officer (in view of the absence of a Chief Financial Officer) on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities. Our cybersecurity program is overseen by the Chief Executive Officer (in view of the absence of a Chief Financial Officer) in conjunction with a third-party service provider. The third-party service provider has the primary responsibility for the Company's cybersecurity risk management program. At the time an incident is identified, the Company completes an evaluation and summarizes the incident that is shared with the Board of Directors to effectively manage resources to reduce risk and prevent future incidents.

stage1Category: Board Governance


text: Incident Disclosure To date, the Company has been subject to cyber related incidents, as previously disclosed in the Company's Quarterly Report for the quarters ended June 30, 2023 and September 30, 2023 and within this Annual Report. Since the identification of these incidents, we have implemented additional safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company.

stage1Category: Incident Disclosure


text: Cybersecurity Risk Management and Strategy Assessment, identification and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes to promote a company-wide culture of cybersecurity risk management. Our Chief Financial Officer is responsible for the evaluation of material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also regularly use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity consultants, as well as data backup and recovery providers.

companyName: Loop Industries, Inc.

ticker: LOOP


text: We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").


text: The Chief Financial Officer is responsible, with the support of the Company's internal IT staff and external service providers, for helping to identify, assess and manage the Company's cybersecurity threats and risks, using internal resources as well as third-party service providers, by monitoring our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, amongst others, data encryption, risk assessments, network security and access controls, physical security, asset management, and systems monitoring. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls reports of such third-party service providers when onboarding the provider and quarterly thereafter.


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, some of which are managed by a third-party service provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Cybersecurity threats have not materially affected the Company, including its business strategy, results of operations or financial condition. The Company does not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which it is aware are reasonably likely to materially affect the Company.


text: Cybersecurity Governance Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board of Directors oversees management's processes for identifying, monitoring and addressing enterprise risks. In addition, the Audit Committee of the Board of Directors discusses with management the adequacy and effectiveness of the Company's policies and procedures regarding information technology risk management and internal controls related to cybersecurity.


text: Cybersecurity Governance Our executive team and Board of Directors are actively involved in overseeing cybersecurity risks. The executive team and the CIO oversee the Company's information security efforts and cybersecurity governance. This team regularly reviews our cybersecurity posture and any incidents that have occurred.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the Chief Financial Officer is responsible for hiring appropriate personnel and engaging external service providers with relevant cybersecurity expertise, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the Chief Financial Officer provides reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. The Chief Financial Officer and relevant department heads work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Cybersecurity Risk Management and Strategy We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. To prevent, detect and respond to information security threats, we maintain a cyber risk management program that employs Cyber Security Framework ("CSF") in accordance with the National Institute of Standards and Technology ("NIST") security framework. CSF is a set of voluntary guidelines that help organizations assess and improve their cybersecurity posture by implementing processes for identifying and mitigating risk, and detecting, responding to and recovering from cyberattacks.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.


text: Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by Company-wide testing initiatives.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers or who have access to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: While we have not, as of the date of this Report, experienced any material cybersecurity incidents that materially affected us, including our operations, business strategy, results of operations, or financial condition, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business, financial condition, results of operations. See "Risk Factors – We are exposed to cybersecurity threats or incidents."


text: Cybersecurity Governance One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee has primary responsibility for oversight of information security risks, including fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks, and provides regular updates to the Board of Directors on such matters. The Audit Committee receives regular reports from our Chief Operating Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Information security risk is a significant oversight focus area for the Audit Committee, as well as the entire Board of Directors. Over the course of fiscal year 2024, the Audit Committee received four separate cybersecurity briefings from our Chief Operating Officer.


text: The management of our cybersecurity risks is led by the CIO and the executive team who bring over 35 years of combined experience in cybersecurity, IT, and risk management. This team is responsible for the overall cybersecurity risk management program, collaborating with internal teams, external consultants, and cross-functional divisions. Their efforts are supported by threat intelligence from various sources, and they regularly benchmark our security practices against the NIST CSF.


text: Our Chief Operating Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer, who leads a team responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, has extensive experience and background in information technology, cybersecurity, enterprise strategy, risk management. Additionally, our Chief Operating Officer chairs our Cybersecurity Incident Response Team, which is responsible for prevention, identification, containment, eradication and remediation of cybersecurity incidents. He consults with experts in enterprise security and risk management to ensure our intellectual property and devices are protected. While we have not experienced a material information security (cybersecurity) incident, we maintain an information security (cybersecurity) risk insurance policy as a matter of good practice.


text: We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats.

companyName: PALATIN TECHNOLOGIES INC

ticker: PTNT


text: We engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.


text: The Company's employees are required to sign confidentiality agreements in an effort to, among other things, help to ensure cybersecurity. The Company has taken measures to better ensure that key employees are aware of data security threats (including cybersecurity threats), and Company security policies and procedures, as appropriate. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures may result in disciplinary action.


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our internal computer systems, or those of our third-party contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs."


text: While our board of directors is responsible for oversight and risk management in general, our audit committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The audit committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents. Our management team is responsible for assessing and managing the material risks from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We have established and implemented a comprehensive cybersecurity risk management program aimed at safeguarding the confidentiality, integrity, and availability of our critical information technology ("IT") systems and sensitive information.


text: Our cybersecurity risk management program is fully integrated within our broader enterprise risk management framework, leveraging consistent methodologies, incident reporting channels, and governance processes. These approaches are used not only for cybersecurity risks but also for managing other areas of risk, including legal, compliance, strategic, operational, and financial. The program is continuously assessed and refined, using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guiding tool to identify, prioritize, and manage cybersecurity risks that could significantly affect our operations, financial performance, or business objectives.


text: Cybersecurity Incident Response Plan ("CIRP"): Our CIRP ensures we are prepared to respond to, report, and remediate any cybersecurity incidents effectively. Led by the Chief Information Officer ("CIO"), our corporate compliance and risk management team manages all aspects of incident response. For significant incidents, additional third-party resources would be mobilized to mitigate impact on the business.


text: Continuous Vulnerability Management: We continuously monitor our IT networks and legacy systems to identify threats that may adversely affect critical systems and information, ensuring that our broader IT environment remains secure.


text: Third-Party Cybersecurity Consultants: We engage trusted third-party cybersecurity experts to enhance our security posture, perform assessments, and provide strategic guidance, ensuring continuous improvement in our cybersecurity approach.


text: Cybersecurity Awareness Training: Employees, incident response teams, and senior management undergo regular training to ensure awareness of evolving cybersecurity threats and the appropriate responses.


text: Our CIO reports regularly to the executive team, providing updates on cybersecurity strategies, current threats, and long-term planning. Additionally, the CIO provides an annual cybersecurity update, presenting an overview of significant cybersecurity risks and their potential impact on internal controls.


text: In the event of a significant cybersecurity incident that escalates to a corporate crisis, the executive team and the Board will be engaged in alignment with the corporate compliance and risk protocols.


text: While LightPath Technologies faces various cybersecurity threats as part of routine operations, no risks have been identified to date that could materially impact the company's operations, strategy, financial condition, or overall business performance.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our board of directors and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: Luvu Brands, Inc.

ticker: LUVU


text: Network and endpoint protection: Utilizing firewalls, intrusion detection systems, antivirus software, and advanced encryption protocols to safeguard sensitive data and systems.


text: Employee training and awareness programs: Educating employees on cybersecurity best practices and conducting phishing simulations to promote vigilance against social engineering attacks.


text: Incident detection and response plans: Maintaining real-time monitoring and implementing a structured incident response plan that allows us to quickly detect, respond to, and recover from cyber incidents.


text: Third-party risk management: Assessing the cybersecurity controls of vendors and partners to ensure that their practices align with our standards for protecting sensitive information.

stage1Category: Third-Party Risk


text: While we have not experienced a cybersecurity incident that has had a material impact to date, the threat of potential incidents remains high. We continually evaluate our exposure to risks such as: Operational disruption from ransomware or other cyberattacks. Data breaches that could compromise customer or proprietary information. Regulatory and legal exposure arising from cybersecurity failures.


text: As part of our risk management framework, we regularly assess whether any cybersecurity incidents, or the likelihood of such incidents, could materially affect our business. We are also committed to continuous improvements to address emerging threats. Governance.


text: Our board of directors plays an active role in overseeing the company's approach to managing cybersecurity risks. The board receives regular updates from senior management regarding the company's cybersecurity strategy, potential risks, and any incidents that may arise. These updates ensure that the board remains informed and able to provide guidance on cybersecurity matters.


text: The Board is also regularly briefed by our director of information technology (IT) on the Company's cybersecurity policies, risk assessments, and mitigation strategies. This reporting structure allows the board to remain engaged with the company's efforts to address and manage evolving cyber threats, ensuring that cybersecurity is aligned with our overall risk management framework.


text: Management, led by the director of IT, plays a critical role in assessing and managing material risks related to cybersecurity. This includes implementing day-to-day cybersecurity measures, conducting regular risk assessments, and ensuring the timely response to any cyber threats or incidents. The director of IT is responsible for ensuring that cybersecurity is integrated into our company's broader risk management strategy, with direct reporting lines to both senior executives and the board of directors.


text: Additionally, management conducts regular tabletop exercises and incident simulations to assess readiness for potential cyber threats and continuously evaluates the effectiveness of our cybersecurity defenses.


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: PEDEVCO CORP

ticker: PED


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things, implemented (i) multi-factor authentication and password protection requirements for accessing all Company systems and applications such as Company electronic mail and the Company's banking and accounting environments, (ii) a secure email gateway using GoSecure that combines machine learning, behavioral scanning, exploit detection, signature-based detection and structure heuristics to provide defense against phishing and business electronic mail compromise attacks, spam, polymorphic malware, theft and other dangerous offensive content, (iii) endpoint protection using Microsoft Defender on Company and employee computers and Company-provided devices, (iii) a physical networking room with restricted access to only authorized personnel, (iv) regular cybersecurity training, awareness, and threat updates programs to keep all Company personnel updated and informed regarding emerging threats and best practices, and (v) daily cloud backups of the Company's accounting environment. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Failure of our information technology systems, including cybersecurity attacks or other data security incidents, could significantly disrupt the operation of our business." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our management team is responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.


text: As of and for the year ended December 31, 2024, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.


text: Although we have designed our cybersecurity program and governance procedures discussed above to mitigate cybersecurity risks, we may in the future experience cybersecurity risks, threats and attacks. To date, no risks, threats or attacks have had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact on us in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: We maintain a comprehensive process following standard compliance frameworks (i.e., NIST) for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We closely follow the security industry and global threat trends, and our security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Our team consists of professionals with deep cybersecurity expertise across multiple industries, including our Director of Infrastructure Management (our ISO) and our Vice President, Cybersecurity Services. Our executive leadership team, along with input from the above professionals, are responsible for our overall enterprise risk management process and regularly consider cybersecurity risks in the context of other material risks to the Company. Should an incident arise or be identified, they reviewed by a cross-functional team to determine whether further escalation is appropriate, with any material incident being escalated to the appropriate members of the technical management teams.

companyName: INFINITE GROUP INC


text: As part of our cybersecurity risk management system, we track and log privacy and security incidents across IGI, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional team to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: The Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Our cybersecurity and risk management program is designed to protect the confidentiality, integrity, and availability of our critical information systems and the data they hold. Due to the nature of our business and our customers, we face many potential cybersecurity challenges and threats, including attempts to gain unauthorized access to our intellectual property, trade secrets, codebase, proprietary or confidential information, fraud, denial-of-service attacks, attacks from foreign nations, as well as threats to our identity and personnel. Because we operate in financial-technology and data-sensitive environments, we expect these threats to continue to evolve and increase in complexity. We have implemented IT systems and processes designed to help defend against the ever-evolving threat landscape while remaining agile to keep up with such threats. As we expand efforts in the financial technology sector, we will continue to invest in strengthening and supporting a robust cybersecurity posture and defense.

companyName: USBC, Inc.

ticker: USBC


text: We leverage a combination of cybersecurity frameworks to protect our assets. We use the controls from these frameworks as well as guidelines and best practices from the industry to develop our cybersecurity plan. Our cybersecurity plan and its elements are reviewed regularly to ensure they meet the requirements and expectations of our security needs. We have a cybersecurity policy in place, which includes monthly meetings with internal cybersecurity and technology experts to review and maintain the procedures, ensuring they reflect current best practices.


text: Our cybersecurity program is spearheaded by our cybersecurity department, with support from external advisors and approval from executive management. The stakeholders have been identified and know their roles within the documented cybersecurity process.


text: Our Board of Directors receives periodic reports and annual updates on our cybersecurity posture, and both the Chief Information Security Officer and the Chief Financial Officer share responsibility for our program and solicit support from third-party experts as necessary. Our cybersecurity team consists of highly senior resources holding multiple certifications and degrees relating to cybersecurity and best practices.


text: Risk is assessed based on multiple factors and is overseen by the Audit Committee. Our IT and cybersecurity teams update and maintain our digital asset inventory to ensure all digital assets are included in our risk management process. The same is also true for all physical records/files as well as physical assets that would be considered intellectual property. Key assets are identified, and risk is assessed based on business impact, availability of information, and attack feasibility. After the risks have been identified, they are reviewed with the Audit Committee and stakeholders to create action plans or exception requests for the acceptance of risk.


text: We leverage third party applications and software, as well as vulnerability and cybersecurity testing by third party cybersecurity experts, to help identify vulnerabilities within our system's boundaries. These vulnerability lists are used to create remediation plans and are prioritized based on severity and attack feasibility.


text: An incident response plan has been established, which provides detailed information on actions to take in the event of an incident. The plan defines the incident response team, details the incident response lifecycle, and provides templates to make the process easier to document and follow. Timelines, communication methods, and notification information are included in the plan to ensure the process can be followed in high-pressure situations that can occur during incidents. We have had no material cybersecurity incidents in the last 24 months. However, during the fiscal year ended September 30, 2025, our leased office was physically broken into through a firemen's access conduit in an isolated physical security incident that did not result in a material impact on our operations, financial condition or results of operations. No items/assets were taken and the access conduit has since been disabled. We are in the process of installing additional physical security measures to make the location less vulnerable to unauthorized entry.


text: Sensitive and confidential data are an essential part of our business. We leverage a cybersecurity policy that identifies the type of information we store and what level of encryption and access role entitlement is required to store and access the data. This document also details the overarching requirements for encryption, such as encryption methods, and secret/key storage and retention. These requirements are periodically reviewed to ensure continued alignment with industry standards and regulatory expectations.


text: CEL-SCI recognizes the importance of assessing, identifying, and managing material risks from cybersecurity threats. CEL-SCI's policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into its overall risk management system. In this regard, CEL-SCI uses various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, routine employee awareness updates, annual cyber security training, monthly email testing engaging experts and third-party monitoring and detection tools.

companyName: CEL SCI CORP

ticker: CVM


text: CEL-SCI employs third-party information technology ("IT') consultants to manage its information technology environment and help manage and assess cybersecurity risks. The third-party IT consultants have relevant industry experience, including security solutions and data protection and recovery. Using various monitoring and detection tools implemented into CEL-SCI's internal technology systems, they can identify cybersecurity threats and report such risks to CEL-SCI's management team.


text: CEL-SCI's management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over its third-party IT consultant, monitoring systems and employee engagement. The management team is responsible for reporting any cybersecurity risks identified by CEL-SCI's third-party IT consultant to its board of directors.


text: CEL-SCI's board of directors is responsible for oversight over its risk management system, including review and approval of the risk management system and processes implemented by management to identify, assess, manage and mitigate cybersecurity risks. The Board is responsible for monitoring and assessing material risk exposure to cybersecurity risks, and CEL-SCI's management is responsible for the day-to-day supervision of the material risks CEL-SCI may face.


text: CEL-SCI's risks from cybersecurity threats have not affected or are reasonably not likely to materially affect its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program led by the Company's Vice President, IT, that is designed to protect the confidentiality, integrity, and availability of the Company's data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third party risk management process for service providers, suppliers, and vendors.


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A, Risk Factors—Risks Related to Our Intellectual Property, Information Technology, Cybersecurity and Privacy—A cybersecurity incident, other technology disruptions or failure to comply with laws and regulations relating to privacy and the protection of data relating to individuals could negatively impact our business, our reputation and our relationships with customers.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and in February 2024, delegated to the risk committee of the board of directors ("Committee") oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. Prior to February 2024, the board of directors had delegated this oversight to the audit committee of the board of directors. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full board of directors regarding its activities.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Verona Pharma plc

ticker: VRNA


text: Our IT team, including our Vice President of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our IT team have over 10+ years of experience in operations technology support across multiple industries. The team holds industry standard certifications, related to System, Security and Network Administration, and are required to complete security awareness training multiple times per year.


text: Our IT team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program that is designed to protect the confidentiality, integrity, and availability of the Company's data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A. Risk Factors—Risks Related to Our Intellectual Property, Information Technology, Cybersecurity and Privacy—A cybersecurity incident, other technology disruptions or failure to comply with laws and regulations relating to privacy and the protection of data relating to individuals could negatively impact our business, our reputation and our relationships with customers.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and in February 2024, delegated to the risk committee of the board of directors ("Risk Committee") oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. Prior to February 2024, the board of directors had delegated this oversight to the audit committee of the board of directors. The Risk Committee oversees management's implementation of our cybersecurity risk management program.


text: The Risk Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Risk Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Risk Committee reports to the full board of directors regarding its activities.


text: Our IT team, including our Director of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our IT team have over 10+ years of experience in operations technology support across multiple industries. The team holds industry standard certifications, related to System, Security and Network Administration, and are required to complete security awareness training multiple times per year.


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to provide protection for our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, as well as secure our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We have engaged external parties, including consultants, computer security firms and risk management, and governance experts, to enhance our cybersecurity oversight. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: ARVINAS, INC.

ticker: ARVN


text: The Company does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Our Audit Committee of our Board of Directors, or the Audit Committee, provides direct cybersecurity risk oversight, and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management and the Cybersecurity Board, as discussed in further detail below, regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: We have a cross-functional Cybersecurity Board led by our Vice President of Information Technology & Corporate Projects serving as the chair and consisting of executive-level and non-executive level leaders, including among others, our Chief Financial Officer. This board is responsible for reviewing, engaging and making decisions related to the execution and continuous improvement of cybersecurity strategy, processes and governance impacting our information systems, employees, partners and patients. Our Vice President of Information Technology & Corporate Projects leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Vice President of Information Technology & Corporate Projects is an experienced senior leader with more than 20 years of experience in information technology within the pharmaceutical industry leading a team of employee and consultants with a breadth of experience including security management experience along with CISSP certification.


text: In an effort to deter and detect cyber threats, we periodically provide our workforce, including all employees and contingent staff, with a privacy, data protection, cybersecurity and incident response, and prevention education and awareness program, which includes annual and supplemental training covering timely and relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. In addition, we perform monthly phishing test campaigns to reinforce identification and reporting training. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. Lastly, we perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to provide protection for our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, as well as secure our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. As part of our overall risk mitigation strategy, we maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We have engaged external parties, including consultants, computer security firms and risk management, and legal and governance experts, to enhance our cybersecurity oversight. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.


text: Based on an assessment using the previously described risk mitigation strategy, we do not believe there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See "Our internal computer systems and those of our collaborators, contractors, consultants and other third parties are vulnerable to cyber attacks, cyber intrusions and security breaches, which could not only materially disrupt our business operations and result in the loss of confidential information, but could also damage the integrity of our clinical trials, impact our regulatory filings, compromise our ability to protect our intellectual property, and subject us to regulatory actions that could result in significant fines or other penalties" in Part I, Item 1A. "Risk Factors" for additional information.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: Our Audit Committee of our Board of Directors, or the Audit Committee, provides direct cybersecurity risk oversight, and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management and the Cybersecurity Board, as discussed in further detail below, regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity risks, threats or incidents. We also provide updates to the full Board of Directors regarding cybersecurity risks, threat landscape and risks, as appropriate.


text: We have a cross-functional Cybersecurity Board led by our Senior Vice President, Information Technology Systems & Security serving as the chair and consisting of executive-level and non-executive level leaders, including among others, our Chief Financial Officer and General Counsel. This board is responsible for reviewing, engaging and making decisions related to the execution and continuous improvement of cybersecurity strategy, processes and governance impacting our information systems, employees, partners and patients. Our Senior Vice President, Information Technology Systems & Security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Vice President, Information Technology Systems & Security is an experienced senior leader with more than 25 years of experience in information technology within the pharmaceutical industry leading a team of employees and consultants with a breadth of experience including security management experience along with CISSP certification.


text: In an effort to deter and detect cyber threats, we periodically provide our workforce, including all employees and contingent staff, with a privacy, data protection, cybersecurity and incident response, and prevention education and awareness program, which includes annual and supplemental training covering a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. This education and awareness program functions to educate employees on the importance of reporting all incidents immediately. In addition, we perform monthly phishing test campaigns to reinforce identification and reporting training. We automatically assign online reinforcement training upon initial phish test failure and may follow-up one-on-one as needed. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. Lastly, we perform annual penetration tests conducted by independent, third-party cybersecurity firms and ongoing vulnerability assessments conducted by the internal security team.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which i is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Capital Corp II


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting confidential business, client, investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the " C-ROC "), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: The Audit Committee is primarily responsible for oversight and review of guidelines and policies with respect to risk assessment and risk management. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "ITEM 1A. Risk Factors - Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


companyName: Blue Owl Capital Corp

ticker: OBDC


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.


text: We describe risks related to cybersecurity threats that could materially impact our business strategy, results of operations or financial condition under the heading "Risk Factors." Material impacts could include loss of access to systems and data, financial costs and reputational harm, among others.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL

stage1Category: None/Other


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: The Audit Committee is primarily responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Our information technology ("IT") networks and related systems are essential to the efficient operation of our business and our ability to perform day-to-day operations (including managing our building systems and accounting for our business operations). In some cases, our clients' operations depend on our building systems. The risk of a security breach, incident, compromise or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access of our network, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions and other events of varying degrees. To date, these events have not, individually or in the aggregate, materially affected our operations or business. In addition, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" for additional discussion of the cybersecurity risks related to our Company.

companyName: BXP, Inc.

ticker: BXP


text: Cybersecurity Risk Management & Strategy We have implemented and maintain a cybersecurity program that is designed to identify, assess and manage risks from cybersecurity threats and was established by reference to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The primary goal of our cybersecurity program is to prevent cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We aim to take an active approach to monitoring and evaluating our cybersecurity threat environment and risk profile as part of our cybersecurity program, which is administered by our information systems ("IS") department, led by our Senior Vice President, Chief Technology Officer ("CTO") and Senior Vice President, Chief Information Officer ("CIO," together with our CTO, "IS Leaders"). Our IS Leaders are primarily responsible for the direction and implementation of technology, applications and security at BXP. Our CTO has extensive technology and program management experience with approximately 40 years of technology experience, 26 years of which have been with BXP and a total of 30 years with publicly-traded REITs. In January 2024, our IS leadership expanded to include our CIO, who has 30 years of technology experience developed across multiple industries, including commercial real estate, in guiding organizations through strategic initiatives that span technology, cybersecurity, and digital transformations.


text: We maintain written information security policies and procedures, including a Cybersecurity Incident Response Plan ("CIRP") for incidents involving potential or actual compromises of information security. Our CIRP is overseen by the cyber executive response team, which is chaired by our Vice President, Risk Management and includes representatives from our IS and legal departments. In the event of a cybersecurity incident, we have implemented procedures to (i) mobilize third-party subject matter experts and (ii) notify executive leadership and the Audit Committee and/or the full Board of Directors, in each case, as appropriate.


text: As part of our overall cybersecurity program, we also conduct: • Regular assessments of our cybersecurity program. We assess our cybersecurity program against the NIST Cybersecurity Framework through annual internal assessments, and, every two years, we engage a third-party consultant to conduct an additive cyber assessment. These assessments review, among other things, our IT security measures and activities for alignment with the NIST Cybersecurity Framework. • Periodic penetration testing & vulnerability assessments. On an annual basis, we engage a third-party consultant to conduct two penetration tests per year. We also conduct vulnerability assessments on a monthly basis. • Regular cybersecurity awareness trainings & simulations. We conduct cybersecurity awareness training for employees and primary on-site providers during onboarding, and thereafter, multiple times per year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other security threats, as well as annual tabletop simulations.


text: In addition, our internal audit function integrates the assessment and identification of cybersecurity-related risks into our annual overall enterprise risk assessment ("ERA"). The ERA process is designed to assess and identify the key risks that management believes could adversely impact our business operations or impede the achievement of our business objectives, which includes an assessment of our cybersecurity program and the cybersecurity-related risks that we face. To the extent the ERA identifies a heightened cybersecurity-related risk(s), we have implemented a process for the risk(s) to be presented to the Audit Committee and the full Board of Directors, as appropriate.


text: We utilize certain third-party service providers to perform select functions. These third-party service providers also face cybersecurity threats, and a cybersecurity incident impacting any of our third-party service providers could also indirectly affect our operations, performance and results of operations. We have a data security committee, consisting of members from various BXP departments, including IS, legal and risk management, that meets periodically to assess, identify and manage cybersecurity risks related to certain third-party service providers and to protect our critical financial and sensitive business information, as well as personally identifiable information (collectively, "Sensitive Information"). The data security committee has implemented processes for evaluating the risk profile of those service providers that handle or have access to Sensitive Information, which informs applicable contractual obligations with these service providers. This evaluation, which occurs prior to onboarding, is designed to consider the nature of the services to be provided, the level of sensitivity and quantity of the information that the service provider handles or has access to, and the identity of the service provider.