text: Management's cybersecurity risk management strategy and processes focus on several key areas, including: • Incident Response Planning: Getty Images has a global Information Security Incident Response Plan (the "Plan") for identifying and managing cyber and data security threats. The Plan defines the roles and responsibilities of Company stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. A cross-functional working group of security, privacy, and legal personnel review significant incidents to determine if further escalation is appropriate. If an incident could be deemed material, it is escalated to the CTO and other members of the executive team, and we consult with outside counsel during this assessment as appropriate. • Technical Safeguards: Getty Images seeks to continuously improve technical safeguards that are designed to protect its information systems. Standards include controls for identity and access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While Getty Images seeks to maintain adequate cybersecurity controls, it may not always be effective. See "Item 1A. Risk Factors—Our failure to protect the proprietary information of our customers and our networks against cyberattacks, security breaches or unauthorized access could adversely affect our business and results of operations, damage our reputation and expose us to liability" and "We collect, store, process, transmit and use personal information, which subjects us to governmental regulation and other legal obligations in many jurisdictions related to privacy, information security and data protection" for more information as well as related risks. • Education and Awareness: We require annual employee trainings on privacy and cybersecurity, records and information management, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population. • Third-Party Risk Management: We rely on certain third-party computer systems and third-party service providers in connection with providing some of our services. We also depend upon various third parties to process payments for our transactions around the world. These third-party business partners, service providers, and consultants need to access our customer and other data and in some cases connect to our computer networks. We define expected security and privacy requirements through our contracting processes with third parties and we perform third-party cyber risk assessments to monitor the cyber risk management efforts of third parties as needed. • Threat Intelligence: Our security teams engage in threat intelligence, predictive modeling, and penetration testing to understand the Company's threat landscape and reduce the risk and impact of cybersecurity incidents.


text: Material Effects of Cybersecurity Incidents As of the date of this Annual Report, we have experienced cybersecurity incidents and threats, including malware, phishing, partner and customer account takeover attacks, and denial-of-service attacks on our systems. We do not believe these cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in "Item 1A. Risk Factors" in this Annual Report, as updated by Getty Images' subsequent SEC filings. The risks described in such filings are not the only risks facing Getty Images. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial may materially adversely affect Getty Images' business, financial condition, or results of operations.

companyName: Getty Images Holdings, Inc.

ticker: GETY

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: Cybersecurity Risk Management and Strategy The Company recognizes the security of our banking operations is essential to protecting our customers, maintaining our reputation, and preserving the value of the Company. The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Enterprise Risk Management Program establishes policies and procedures for assessing the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program including its cybersecurity risk management program: Federal Financial Institutions Examination Counsel Cybersecurity Assessment Tools and GLB Act and regulations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach focused on the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents that may occur.

companyName: SHORE BANCSHARES INC

ticker: SHBI

stage1Category: Risk Management Process


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Enterprise Risk Management Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the section titled "Governance," the Board Risk Oversight Committee has delegated to senior management responsibility for managing the Enterprise Risk Management Program. Senior management carries out this mandate through the Strategic Initiatives and Board Risk Oversight Committees. To maintain alignment and appropriate insight regarding information security activities, a bi-weekly operational committee provides general program insight. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, assessing, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management. • Security Competencies: The organization oversees a program of security competencies and tools designed to evaluate security risks and to protect the confidentiality, integrity and availability of our information systems and data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense and Incident Response Plan: The Company utilizes sophisticated security monitoring and detection tools for continuous monitoring of our information systems 24 hours per day, seven days per week. The Company utilizes third-party tools and solutions to actively deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. We also receive the latest cybersecurity alerts and threat intelligence from government agencies and information sharing and analysis centers. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidance on our response to incidents by focusing on the coordination of personnel, policies, and procedures to ensure incidents are detected, analyzed and managed. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven by risk factors established by the Vendor Management Program. The process provides awareness and collaboration across all internal teams including Information Technology and Risk Management. A review process is conducted on new or significantly changed key third parties, to ensure certain cybersecurity baseline requirements are met and cybersecurity incidents are appropriately disclosed. This process is aimed at advocating for appropriate standards and controls, based on risk factors, to secure the third parties' information systems, and to ensure the third parties have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.


text: The Company leverages continuous monitoring and regular risks assessments to identify the Company's current and potential cybersecurity risks. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board Risk Oversight Committee.


text: is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants.

companyName: Vestand Inc.

ticker: VSTD

stage1Category: Management Role

stage1Method: majority


text: Cybersecurity Governance The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board Risk Oversight Committee reviews and approves the Information Security Policy, which includes the Company's cybersecurity risk management program. The Board of Directors receives regular presentations and updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, risk and vulnerability assessments, independent audit reviews, and technological trends. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full board of directors discusses the Company's approach to cybersecurity risk management.

stage1Category: Board Governance


text: The Information Security Officer, under the guidance of our Chief Risk Officer and Operational Risk Manager, works collaboratively across the Company to implement a program designed to protect the Company's information systems and data from cybersecurity risks. The Information Security Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents in accordance with the Company's Incident Response Plan and Business Continuity Plan, and reporting incidents to appropriate personnel at the Company in accordance with the Incident Response Plan. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The Information Technology and the Operational Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Information Security Officer and Chief Information Officer and ultimately the Board Risk Oversight Committee when appropriate. The Information Security Department has over three decades of experience in managing Information Security and Cybersecurity programs at financial institutions. The Information Security Officer holds the Certified Information Security Manager Certification and is supported by additional team members with extensive backgrounds in cybersecurity and related fields.


text: Notwithstanding our efforts at cybersecurity, the Company cannot guarantee that it will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors – Risks Related to Our Business.


text: Risk Management and Strategy Mattel has processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which include developing, implementing, and maintaining cybersecurity measures and controls. Mattel considers the following factors, among others, to assess whether adequate protections are in place to address risks from known and anticipated cybersecurity threats: likelihood and severity of risk; impact on Mattel and others, including retail customers, suppliers, consumers, or employees, if a risk materializes; feasibility and cost of controls; and impact of controls on operations.

companyName: MATTEL INC /DE/

ticker: MAT


text: As part of its cybersecurity risk management program, Mattel utilizes cybersecurity assessors, consultants, auditors, and other third-parties to assist its internal team with network security, cloud security, endpoint security, data loss prevention, and security information and event management. In addition, Mattel utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents.


text: Mattel seeks to identify vulnerabilities and mitigate risks from cybersecurity threats posed by its use of third-party technology, information systems, and service providers through oversight by Mattel's information technology ("IT") organization through a variety of processes, including conducting onboarding due diligence, imposing contractual obligations related to privacy and information security, and regularly monitoring the performance of third parties providing critical support systems.

stage1Category: Third-Party Risk


text: To support incident response preparedness, Mattel has developed a cybersecurity incident response plan and conducts an annual simulated incident exercise. The cybersecurity incident response plan addresses cybersecurity incidents that directly impact Mattel or arise from Mattel's use of third-party technology, information systems, and service providers. Mattel also utilizes business continuity and disaster recovery plans to prepare for potential disruptions in technology that Mattel relies upon. Further, Mattel monitors novel and advanced cybersecurity threats and provides ongoing employee security awareness training.


text: As part of Mattel's overall risk management program, Mattel's IT organization has a governance, risk, and compliance group that provides oversight regarding IT-related risks, including cybersecurity risks, and monitors Mattel's IT control environment. This group also works with Mattel's Internal Audit team to assess Mattel's cybersecurity processes. In addition, Mattel's IT organization has a steering committee comprised of internal privacy and cybersecurity experts, chaired by Mattel's Chief Information Security Officer ("CISO"), which is responsible for the development and maintenance of Mattel's privacy and information security programs and regularly reports to Mattel's Chief Technology Officer ("CTO").


text: Mattel is subject to cybersecurity threats that could have a material adverse impact on its results of operations, financial condition, and liquidity, as further discussed in Item 1A "Risk Factors" under the headings of Legal and Regulatory. Mattel is not aware of having experienced any cybersecurity threats or incidents to date that have materially affected or are reasonably likely to materially affect Mattel, its business strategy, results of operation or financial condition. However, there can be no assurance that Mattel will be able to mitigate negative impacts in the same way in the event of future attacks or other cyber incidents.


text: Mattel's CISO has more than twenty years of cybersecurity industry experience at Mattel and elsewhere and is responsible for coordinating cybersecurity efforts within Mattel, with a focus on cybersecurity threat prevention, detection, and mitigation, as well as enhancement of privacy and security measures, including security updates, security architecture and engineering, and identity access management. Mattel's CISO reports to the CTO, regularly communicating risks and other relevant information related to cybersecurity threats and incidents. Mattel's CTO has significant leadership, cybersecurity, and technology experience, is responsible for overseeing the monitoring and mitigation of cybersecurity threats, and advises and consults Mattel's senior management regarding material cybersecurity risks.


text: A team led by the CISO implements and maintains systems designed to detect and prevent cybersecurity threats, monitors important developments that may present risk to Company and third-party systems, and oversees the results of internal and third-party security reviews. The CISO provides regular updates to Mattel's CTO regarding critical and major severity security incidents involving Company systems, security incidents involving third parties that have the potential to impact Mattel's operations or involve sensitive customer, supplier, consumer, or employee data, and mitigation and remediation implemented to address such threats or incidents.


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees the Company's assessment and management of material cybersecurity risks. The CTO reports to the Audit Committee on Mattel's cybersecurity, including material cybersecurity risks and mitigation, at least annually. The CTO reports and escalates cybersecurity incidents to management and the Audit Committee as appropriate.


text: We recognize the crucial importance of identifying, assessing, and managing material risks from cybersecurity threats. We are committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard our systems and data, including the data of our customers.

companyName: Community West Bancshares

ticker: CWBC


text: Information Security Risk Management and Strategy We manage our cybersecurity risk in accordance with our Information Security Program, which is applicable to all users of our information technology assets, information assets, and facilities, including our directors, officers, employees, temporary workers, business partners, contractors, vendors, service providers, and individuals affiliated with third parties. The Information Security Program includes a dedicated Cybersecurity Incident Response Plan (the "CIRP"), which sets forth the rules and requirements for detecting, investigating, containing, eradicating, and resolving information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) a collection of Security Incident Forms, which delineate the processes for reporting, classifying, investigating, documenting, and communicating information security incidents and (ii) Security Guidelines and Baseline Protections, that establish the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual) in connection with security incidents.


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Acceptable Use Policy which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident be reported to a member's direct supervisor, IT Management, and / or the Information Security Officer, to initiate the internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident are led by the Information Security Officer and the Incident Response Team ("IRT") in accordance with the CIRP.


text: Following this initial stage, we gather and update impact information and related documentation for such incidents. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of severity level "One," "Two," or "Three" identifies next steps for escalation and communication following the initial investigation of the potential incident. Upon escalation of an incident, per our Information Security Program, the IRT and ISO review and validate the initial determination of the priority of the incident prior to entering into subsequent investigative and response stages. Upon validation, the IRT and ISO will engage the Company's technology service provider to respond to the incident and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, the Company's technology service provider assigns technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident and as determined by the Security Incident Forms, we engage in predefined follow-up activities to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Information Security Officer ("ISO") coordinates with other members of our Incident Response Team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The ISO also provides annual reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The ISO is responsible for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our Information Technology Steering Committee and/or the Board of Directors Technology Committee. The ISO reports to the Senior Risk Officer.


text: The ISO has over 15 years of industry experience including management of cybersecurity, enterprise telecommunications infrastructure, and vendor relationships as well as possessing both undergraduate and graduate level degrees, including a Bachelor of Science Information Security and Assurance and Master of Science Information Security and Assurance. Additionally, the ISO was previously certified in 18 industry niches to foster in-depth understanding of technology and its associated risks, including certification as a Certified Ethical Hacker, Certified Computer Hacking Forensics Investigator, Database Design, Web Design, CCNA Routing, Switching, and Security, and is currently enrolled in the International Information System Security Certification Consortium's official Certified Information Systems Security Professional curriculum. Furthermore, the ISO must effectively collaborate with business leaders, executives, and stakeholders. To bolster the collaboration, communication, and business skills necessary to effectively analyze risk holistically, the ISO has undertaken additional graduate level curriculum, including a Master of Business Administration degree program, while maintaining active membership in the National Society of Leadership and Success Honors Society.


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. The ISO performs information security assessments for third party service providers that store or process our confidential data. These information security assessments, include a review of any service organization controls ("SOC") reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor. In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our ISO, nonmember of the executive management team, oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a annual basis and subject to oversight by our board of directors.


text: In the ordinary course of business, our board of directors receives annual updates from the ISO regarding the Information Security Program and compliance with relevant regulations, as described above. Our Information Technology Steering Committee consists of members of the Executive Management Team and department heads with relevant technology experience, and meets on a bimonthly cadence with minutes, reports, and presentations flowing up to the Board of Directors Technology Committee which also meets on a bimonthly cadence. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors via the Directors Technology subcommittee and/or Audit Committee sooner than its next bimonthly update.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.

stage1Category: None/Other


text: The third line of defense is independent Internal Audit, led by our Head of Internal Audit, who is responsible for ensuring that the first and second line of defenses are both designed and operationally effective in mitigating cybersecurity risk through internal audits of including but not limited to: cybersecurity, electronic banking, GLBA/Privacy, information security, information technology, and vendor risk management. The Head of Internal Audit is independent of management and reports to the Board Audit Committee Chair.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Cybersecurity risk management is a critical part of our overall risk management efforts. We have adopted security-control principles based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and other industry-recognized standards, as applicable. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use these principles as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity strategy prioritizes detection, analysis, and response to known, anticipated or unexpected threats. We implement and continue to update risk-based controls to protect key information and systems. Some of the controls and processes in place to manage risks from cybersecurity threats include monitoring systems, enforcement mechanisms, employee training, tools and related services from third-party providers, and management oversight.

companyName: Karat Packaging Inc.

ticker: KRT


text: At least annually, we conduct a cybersecurity risk assessment to identify the inherent cyber security risks and threats to which we are exposed to, evaluate maturity and effectiveness of our systems and processes in addressing such identified risks and threats, and to identify any areas for further enhancements. Our cybersecurity risk assessment considers information from internal stakeholders, known and potential information security vulnerabilities, and data from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on prioritization of initiatives to enhance our security controls, make recommendations to senior management, and if necessary, but at least annually, inform the Audit Committee and Board of Directors.


text: Incident Response and Recovery Planning We maintain an incident response and recovery plan (the "IRR Plan") that guides our activities in preparing for, detecting, responding to, and recovering from cybersecurity incidents. The IRR Plan identifies the working group responsible for the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRR Plan also covers the range of activities we undertake in connection with responding to cybersecurity incidents, including monitoring, identification, investigation, assessment, containment, remediation, and mitigation, as well as compliance with legal obligations including any necessary regulatory reporting. Incidents are evaluated, ranked by severity, and prioritized for response, remediation and reporting, if needed.


text: We also engage third-party security consultants to assist with assessment and enhancement of our cybersecurity risk management program and compliance with applicable practices and standards. Should a cyber security incident occur in the future, we may engage third parties to assist us in responding to the incident as well as enhancing our cybersecurity risk management program, if necessary.


text: The importance of cybersecurity is conveyed internally within the organization as well as externally. Within the organization, our cybersecurity efforts are led by our Information Technology ("IT") Manager who is a Microsoft Certified Professional and holds CompTIA Network+ and Cisco Network certifications. We have also established an IT steering committee consisting of members from various key departments including IT, Finance, Operations, and Human Resources. The IT steering committee convenes at regular periodic intervals and reviews IT strategic and investment priorities, including the Company's cybersecurity programs. Our policies also require each of our employees to contribute to our data security efforts. At least annually, employees are required to attend a mandatory training on how to recognize phishing attempts and how to best handle and report cybersecurity threats.


text: In addition, we collaborate with third party software as a service providers and other service providers to maintain policies and procedures governing our third-party security risks. We evaluate and ensure such third parties maintain appropriate security controls to protect our confidential data, and notify us of material data breaches that may impact our data.


text: Cybersecurity is an important part of our risk management processes and an area of focus for senior management. Our Board of Directors has oversight of our strategic and business risk management, and has delegated cybersecurity risk management oversight to the Audit Committee. Members of the Audit Committee receive updates on an as-needed basis, but at least annually, from senior management. This includes existing and new cybersecurity risks, how management is assessing and addressing such risks, status on key information security initiatives, and cybersecurity incidents, if any, and responses. Members of our Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management program.


text: In the event of a cybersecurity event, a cross-functional steering committee involving the IT, Finance, and Legal departments, would review and assess the incident and determine whether further escalation and regulatory reporting is required. Any incident assessed as potentially being or becoming material is immediately escalated to the Audit Committee, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate.


text: We consult with our outside legal counsel as appropriate, including on materiality analysis and disclosure matters. Senior management makes the final materiality determination and disclosure decisions. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: In 2023, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. There can also be no guarantee that our policies and procedures under our cybersecurity risk management program will be properly followed in every instance or that those policies and procedures will be effective. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Risk Management and Strategy We use a "cloud-only" environment for our information systems; there is no central access point that provides access to all software and related data. We use third-party clinical research organizations ("CROs") to manage all patient-related data and review their cybersecurity procedures as part of vendor evaluation. Our employees do not have access to any patient-identifiable data.

companyName: Fresh Tracks Therapeutics, Inc.


text: The Company has an IT Security Policy that establishes IT security and rules for the Company. This policy covers both good practice quality guidelines and regulations ("GxP") and non-GxP IT systems. With the assistance of a senior IT consultant, management has evaluated the potential cyber risk associated with each of our information systems, both internal and external, taken appropriate steps to mitigate risks, and assigned specific tasks to our Cyber Incident Response Team members in case of a cyber incident. Our Cyber Incident Response Team currently consists of all remaining members of management.


text: Our cybersecurity environment emphasizes the role of each individual user in preventing a cyber incident. We have implemented required monthly video-based cybersecurity training. All users are tested on each training module. This training is supplemented by "test" phishing messages to see if users are alert to cyber risks.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, as further described in Part I, Item 1A, " Risk Factors " in this Annual Report.


text: The Board is responsible for general risk oversight. The Board reviews and evaluates management's evaluation and mitigation of cyber risks as part of its oversight of the Company's Risk Management program. Management periodically reviews cyber risks, incidents, and risk mitigation plans and activities with the Board. In addition to recommendations from our senior IT consultant, we engaged an outside consulting firm to conduct a review of our information systems environment and make recommendations to improve security where appropriate. Management shared the report's findings with the Board and periodically updates the Board regarding our progress on implementing the report's recommendations.


text: As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our critical third-party service providers. These cyber-attackers can attempt to gain unauthorized access to our digital systems for purposes including, but not limited to: misappropriation of company assets, accessing Company confidential or sensitive customer non-public information, corrupting data, causing operational disruptions, or as part of a ransom demand for payment. As described below, we believe we have appropriate risk management processes, governance policies, standards, and procedures, a system of internal controls designed to address and mitigate these risks, and experienced internal resources to execute our information security and cybersecurity risk management programs.


text: In 2020, the Company's Board of Directors approved the implementation of a three lines of defense enterprise risk management framework upon the hiring of our current Chief Risk Officer/Chief Information Security Officer ("CRO/CISO"). Our three lines of defense enterprise risk management framework includes processes and procedures used to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.


text: Within the three lines of defense framework for cybersecurity risk, the first line of defense is provided by the Information Technology department, which is responsible for the design and execution of information security practices and risk mitigation, led by the Company's Business Information Security Officer ("BISO"). The BISO reports to the Chief Information Officer, who leads the Company's Information Technology department.


text: The second line of defense is provided by the Enterprise Risk Management department, which is led by the Company's CRO/CISO. The department seeks to identify, assesses, and monitors cyber risk, in collaboration with our first line, while maintaining independent oversight of our information security program. The CRO/CISO is independent of management and reports to the Board Risk Committee Chair.


text: Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems. The program addresses the roles and responsibilities of the Board, its committees, management, management's committees, as well as each individual Company employee.


text: The Board of Directors is ultimately responsible for the oversight of cybersecurity risk management, with the Board Risk Committee assisting the Board with oversight of the Company's cybersecurity risk program and reporting. The Board of Directors appoints the CISO, and the CISO is given the full authority of the Board for administering and executing the Company's written information security program.. The CRO/CISO delivers an annual report to the full Board of Directors on the status and effectiveness of the Company's written information security program, and reports to the Board Risk Committee any emerging threats or cyber risks on a periodic basis throughout the year. The Board Risk Committee has also approved an Information Security and Cybersecurity Risk Appetite Statement.


text: At the management level, the Enterprise Risk Management Committee ("ERMC") is primarily responsible for cybersecurity risk management. The Committee is comprised of senior executives with risk management and information security expertise. The Information Technology Steering Committee ("ITSC") is a sub-committee of ERMC and is also comprised of senior executives and staff with risk management and information security expertise. ITSC governs the first line of defense cybersecurity risk management activities and furnishes approval items, status reports, and approved Committee minutes to ERMC following a meeting. ERMC governs the second line of defense cybersecurity risk management activities and furnishes key risk indicators, risk assessments, reports, issues and committee minutes to the Board Risk Committee. The CRO/CISO assigns quarterly cyber security training to all Company employees and ERMC reviews and approves the training curriculum on an annual basis. Additionally, the CRO/CISO ensures the Board receives annual cyber security training.


text: We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The CRO/CISO coordinates the Company's response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information. The CRO/CISO informs senior management and the Board Risk Chair and Board Audit Committee Chair as soon as practical if a significant security incident occurs. Formal incident reports, if/when applicable, are reviewed by ITSC, ERMC, and the Board Risk Committee.


text: The Company employs third parties in fulfilling certain aspects of its information security and cybersecurity programs. For example, we engage third parties to: monitor our network 24/7/365, escalate security alerts, when applicable, perform penetration testing, conduct social engineering tests and assist management with technology upgrades/installations. The BISO assists the CRO/CISO in assessing and monitoring information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the CRO/CISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such significant incidents to senior management, ITSC, ERMC, and the Board Risk Committee.


text: While we believe that our cybersecurity programs are appropriate to our risks, cybersecurity threats are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.


text: Notwithstanding the investments made in mitigating our cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this filing, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Risk Management and Strategy The Company implements a comprehensive Information Security Program ("Program") to safeguard data confidentiality, integrity, and availability. The Program leverages recognized frameworks like National Institute of Standards and Technology (or NIST) and Federal Financial Institutions Examinations Council ("FFEIC") to identify, prevent, and mitigate cybersecurity threats. Regular assessments and updates ensure the Program's effectiveness in managing and reducing risk.

companyName: California BanCorp \ CA

ticker: BCAL


text: The Program integrates seamlessly with the company's enterprise risk management program. Continuous threat and vulnerability assessments inform system and control updates, effectively mitigating risks. Layered security controls work together to protect customer information and transactions. Additionally, third-party experts conduct periodic program evaluations through penetration testing, audits, and best practice consultations, with results driving program improvement initiatives. As a regulated entity, Bank of Southern California undergoes regular bank regulatory examinations evaluating the information security program and its compliance with federal regulations.


text: The Company's third-party risk management program oversees and identifies cybersecurity threats associated with service providers. While visibility into third-party operations is limited, risk-based evaluations are conducted. These evaluations involve reviewing security assessment questionnaires, testing summaries, audit reports, and information security policies.


text: Recognizing the importance of continuous security awareness, the Company provides comprehensive employee training. This includes mandatory cybersecurity and fraud training at onboarding, monthly email phishing tests, and annual computer-based training.


text: In addition, the Company has an incident response plan ("IRP") that is in effect if an event is identified by information technology or information security team or one of our third party vendors. The Company's Information Security Officer ("ISO") would activate the IRP and communicate with the team members in accordance with the IRP. If the incident is material, the Chief Risk Officer would disclose the incident to the management Disclosure Control Committee.


text: While no material cybersecurity incidents have been identified during the reported fiscal year, the Company acknowledges the ongoing and evolving nature of cyber threats and remains vigilant in its efforts.


text: The Company's internal controls incorporate a protocol for reporting and escalating information security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board oversees continuous efforts to strengthen operational resilience and receives ongoing education to enhance their oversight capabilities in the face of evolving threats. The ISO, who reports directly to the Chief Risk Officer, periodically updates the Company's Information Technology Committee, the Company's Audit and Risk Committee ("ARC Committee") and the Board of Directors on information and cybersecurity risks, threats, exposures, and mitigation measures. The Company's IRP is regularly tested, incorporating cybersecurity scenarios.


text: The ISO leads program development, implementation, and reporting to the Board. The ISO possesses extensive experience with over 25 years securing information systems and data holding many industry certifications including Microsoft Certified Software Engineer + Security, Exchange Security, Comptia Security+, Pentest+, Cyber Security Analyst(CYSA+), Cisco Certified Network Admin + Security enhancement, Cisco Certified Design architect and Certified Ethical Hacker. Recognizing cybersecurity as a shared responsibility, the Company conducts periodic management-level simulations and tabletop exercises with external resources and advisors as needed.


text: The Board of Directors provides ultimate oversight and monitoring of the Program and its policies. The ARC Committee oversee areas like information technology activities, cybersecurity-related risks, and disaster recovery processes. Additionally, management-level technology and security personnel oversee program management and related assessments, while operational committees manage specific cybersecurity-related risks. While not currently experiencing material impacts, the Company acknowledges the existence of cybersecurity risks.


text: Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a company operating in the technology and software sectors, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to more advanced attacks. Our customers, suppliers and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systematic risks. Below is a discussion of our risk management and approach to governance as it relates to cybersecurity. For additional information on the impact of cyber risks, refer to Part I, Item 1A. "Risk Factors", of this Form 10-K.

companyName: Phunware, Inc.

ticker: PHUN


text: Risk Management and Strategy Cybersecurity risk management is a core tenet of our information technology security program. We have implemented various cybersecurity technologies, controls, and processes to ensure the integrity and availability of our infrastructure, data, and operations. We periodically review and modify these technologies and policies to align with the latest in industry best practices and an ever-changing threat landscape.


text: As part of our cybersecurity risk management program, we perform the following: • Cybersecurity risk assessment is performed on all new products and product updates; • Employ internal staff with security certifications, and we work with third parties to perform security vulnerability testing; • Changes to data protection laws are closely monitored and necessary changes are implemented; • Provide routine security training to employees and communicate any emerging threats; • Review the security posture of all third parties that we engage; • Maintain a comprehensive incident response plan; • Carry cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have not materially affected us to date, including our business strategy, results of operations, or financial condition.


text: Our Vice President of Information Technology, who reports directly to the Chief Executive Officer, manages and monitors our cybersecurity program. Our board of directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks, including cybersecurity risks. The board of directors receives regular updates on cybersecurity and information technology matters and related risk exposures from our executive team.


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the supervision of our board of directors and its committees. Our executive officers are senior investment professionals provided to us through our Manager pursuant to our management agreement with our Manager. Our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of ORIX Corporation USA ("ORIX USA"), a diversified financial company and a subsidiary of ORIX Corporation ("ORIX") and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and Manager relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: To date, Cybersecurity threats, including as a result of any previous Cybersecurity incidents, have not had a material impact nor, are they anticipated to significantly affect the Company, including our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business see, "Part I. Item IA. Risk Factors - the occurrence of cyber-incidents, or a deficiency in our Manager's Cybersecurity or those of any of our third party service providers, could negatively affect our business by causing a disruption to our operations, a compromise of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors is responsible for directing and overseeing our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function. Pursuant to the management agreement between us and our Manager, our Manager is responsible for identifying, assessing, and managing our material risks from cybersecurity threats. Our Manager relies on ORIX USA and ORIX USA information and security team, including the ORIX USA CIO, to provide us with a comprehensive cybersecurity risk management program.


text: Periodically, at least annually, ORIX USA's CIO and/or other members of the ORIX USA information and cybersecurity team will present to the LFT audit committee on various topics relating to ORIX USA's technology risks, including ORIX USA's cybersecurity program (including the results of cybersecurity tabletop exercises), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes and geopolitical cyber threat management) and risk management (including the results of periodic technology audits).


text: Cybersecurity Risk Management and Strategy ORIX USA has a Chief Information Officer (the "ORIX USA CIO"), who leads an information and cybersecurity team (the "ORIX USA information and cybersecurity team") responsible for managing information security at ORIX USA's asset management business, including its Cybersecurity strategy and program, which encompasses annual employee training about Cybersecurity risks and new employee onboarding about ORIX USA's security policies. The ORIX USA information and cybersecurity team's responsibilities cover three main areas: (i) operations and engineering, (ii) threat detection and response, and (iii) governance. The team comprises members with diverse and relevant skill sets and expertise. The ORIX USA CIO leads the cybersecurity team with over twenty years of experience at ORIX USA and prior experience as a principal with a large management consulting firm. This team has developed a program aligned with the NIST CSF framework, emphasizing training and development, with team members holding industry-recognized certifications complemented by industry-recognized third-party providers for threat and incident management.


text: ORIX USA employs a 'defense in depth' cybersecurity strategy and program based on the NIST Cybersecurity Framework, which includes multiple layers of security policies, protections, and controls designed to safeguard the confidentiality, integrity, and availability of infrastructure, network and information assets from malware and threats. This includes the deployment of firewalls, email protection technologies and web gateway, antivirus, and endpoint detection and response ("EDR") systems.


text: Our firewalls (intrusion detection systems and intrusion prevention systems) are designed to secure the organization's perimeter complemented by an antivirus and EDR platform designed to detect malware and threats on systems. Web application firewalls are designed to protect external facing applications, while our email security gateway utilizes machine learning and multilayered detection techniques designed to filter malicious emails.


text: Mobile device management software monitors security events via a Security Information and Event Management platform, managed by a detection and response provider. Mobile device management software is employed with the objective of protecting corporate email and data on mobile devices and is designed to prevent unauthorized data transfer.


text: ORIX USA maintains a Cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of Cyber Incidents. The plan and run books are tested annually through Cybersecurity tabletop simulations where incident response technical, and executive team members go through real-world scenarios focused on current Cyber threats. ORIX USA's Cybersecurity incident response plan provides for escalation of identified Cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of Cybersecurity threats and incidents, assessment of Cybersecurity risk profile or certain newly identified risks relevant to our company, and evaluation of the adequacy of our Cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when the notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including our Manager and officers of LFT.


text: The Company faces cybersecurity threats such as ransomware and denial-of-service. The Company's customers, vendors and business partners face similar cybersecurity threats, and a cybersecurity incident impacting the Company or any of these third-party entities could materially adversely affect our operations, performance and results of operations. In particular, the Company emphasizes the importance of cybersecurity as it may receive, store and transmit personal medical and other information relating to its customers, and believes it is imperative to protect this information from potential threats.

companyName: Verano Holdings Corp.

ticker: VRNO


text: Additionally, the Board recognizes the critical importance of maintaining the trust and confidence of the Company's customers, vendors, business partners and employees. The Board oversees the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's Cybersecurity Incident Response Plan (the "Cybersecurity Plan"), which includes the Company's standards, processes and practices are a component of the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company's Cybersecurity Plan states that it seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on (i) preserving restrictions on information access and disclosing, including means for protecting the confidentiality of personal private and proprietary information, (ii) guarding against improper information modification or destruction, and (iii) ensuring timely and reliable access to the Company's information systems.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Preparing for Cybersecurity Risks: The Company's Cybersecurity Plan lays out on-going processes for incident response and prevention, including processes for bettering Company cybersecurity response following any cybersecurity incidents. All employees undergo training to aid in understanding the Company's expectations for safeguarding all data stored on Company cyber networks. In addition to its Cybersecurity Plan, the Company has established risk management guidelines (the "Risk Management Guidelines") that address the Company's response to risks, including a cybersecurity incident. The Risk Management Guidelines describe the Company's policy of managing enterprise risk, including external risks arising from cybersecurity threats and provide that the audit committee of the Board (the "Audit Committee") will coordinate with and assist the Board in its oversight of risk.


text: The Company's Risk Management Guidelines also dictate that the Board will conduct an annual performance evaluation of the Board's oversight of the Company's overall risk-taking tolerance and management, conducted in such manner as the Board deems appropriate.


text: Identify Risks and Notify Company of Risks: The Cybersecurity Plan dictates an approach to identify and confirm expected incidents, to determine the severity of the risk and promptly take basic initial containment steps. The Cybersecurity Plan includes notification processes for certain cybersecurity incidents which aim to inform and activate an incident response team consisting of officers and employees at the Company and certain external service providers.


text: Containment, Eradication and Recovery: The Company's Cybersecurity Plan includes processes for containing ongoing cybersecurity threats if they occur and preventing past malicious activity, providing proposed solutions to malicious activity, and recovering any business processes with the goal of restoring business operations.


text: Third-Party Risk Management: The Company's Cybersecurity Plan contemplates a Company response to cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: For instance, we utilize our existing information security measures to oversee operational landscapes, address suspicious events, and generate necessary reports shared during our monthly meetings. Additionally, as deemed necessary, we request third-party service providers to furnish System and Organization Controls ("SOC") reports. Simultaneously, we are in the process of revising and formulating new IT policies, standards, and procedures in harmony with the National Institute of Standards and Technology Cybersecurity framework.

companyName: Li-Cycle Holdings Corp.


text: Use of Third-Party Vendors: Per the Company's Risk Management Guidelines, the Board may, in its discretion, delegate all or a portion of its duties and responsibilities to other committees of the Board. While the Board has not yet engaged assessors, consultants auditors or other third parties to aid in processes related to cybersecurity threats, any such committee will have the resources and authority appropriate to discharge its duties and responsibilities, including the authority to select, retain, terminate, and approve the fees and other retention terms of special or independent counsel, accountants or other experts, as it deems appropriate, without seeking approval of the Board or management. The Company may, from time to time, engage third party vendors to assist in developing, identifying and managing risks.


text: Board Oversight: The Board has reviewed and discussed with management, the Company's risk assessment process, risk management framework and reporting mechanisms, implementation and monitoring, including as each of these relates to cybersecurity risks. The Audit Committee coordinates and assists the Board in its oversight of risk. The Board and Audit Committee each receive presentations and reports on Company risks, including cybersecurity risks. The Cybersecurity Plan also contemplates that the Board will also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board has discussed the Company's approach to cybersecurity risk management with the members of management, including the Company's Executive Vice President of Information Technology.


text: Management: The Company has a Cyber Incident Response Team (the "IRT"), which is comprised of employees including, among others, the Executive Vice President of Information Technology, the Chief Financial Officer ("CFO"), the Chief Operations Officer ("COO") and the Chief Legal Officer ("CLO"), as well as potential outside advisors and service providers, as deemed appropriate. The Cybersecurity Plan contemplates that, in the case of a cybersecurity risk, Executive Vice President of Information Technology, in coordination with the IRT, will work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, the Cybersecurity Plan contemplates that multidisciplinary teams throughout the Company will be deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Cybersecurity Plan dictates that the Executive Vice President of Information Technology and the IRT monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The Executive Vice President of Information Technology has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer of other public companies.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See Item 1A of Part 1 – "Risks Related to our Business and Operations – Information Technology, Cybersecurity and Intellectual Property" for additional information on risks related to cybersecurity threats.


text: Information Security Risk Management and Strategy The Company is committed to developing robust governance and oversight of cybersecurity risks and to implementing processes, controls and technologies designed to help assess, identify, and manage material risks. As described further in "—Information and Security and Governance Oversight" below, the Vice President of IT is responsible for Li-Cycle's information security program and as part of its broader risk oversight, the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. Our information technology ("IT"), infrastructure, applications, and networks are susceptible to potential impacts due to the escalating sophistication and frequency of cyber-attacks and security incidents. Breaches in our technology systems, whether from circumventing security measures, denial-of-service attacks, hacking, phishing, computer viruses, ransomware, malware, employee errors, malfeasance, social engineering, vendor software supply chain compromises, physical breaches, or other actions, have the potential to compromise the confidentiality, availability, and integrity of crucial information. Such incidents may cause interruptions or malfunctions in our manufacturing systems, applications, and data processing, thereby disrupting other business operations. Additionally, critical information associated with our business operations is managed by some of our third-party vendors.


text: Anticipating or preventing all cyber-attacks requires an ever-present focus. A cyber-attack or a security incident leading to a breach could disrupt our business operations, harm our reputation, necessitate compliance with data breach notification laws, and subject us to litigation, regulatory investigation, or other liabilities under laws, regulations, and contractual obligations. This could result in increased costs, significant legal and financial exposure, and reputational damage.


text: We invest in information security and data privacy measures to safeguard our systems and data. This includes organizational investments, incident response plans, technical defenses, and employee training. We also utilize a third party to conduct vulnerability scans. Our approach to cyber-security risk management is designed to identify, assess, prioritize and manage major risk exposures that could affect our ability to execute our corporate strategy and fulfill our business objectives.


text: We maintain the availability of cybersecurity consultants as required and regularly conduct vulnerability scans within our environment to identify areas for ongoing enhancements. Additionally, our IT General Controls (ITGC) undergo audits, encompassing processes that overlap with cybersecurity concerns such as access control, permissions, and robust password management. The insights derived from these and other assessments guide us in refining our information security practices, procedures, and technologies.


text: Information Security and Governance Oversight The Vice President of IT is responsible for Li-Cycle's information security program. In this capacity, the executive oversees the enterprise-wide cybersecurity strategy, ensuring the development of policies and standards, the implementation of processes, and the management of architectural elements. The Vice President of IT is responsible for assessing and managing material risks from cybersecurity threats, and is supported in delivering this function with a dedicated internal IT team. The Vice President of IT has over eight years of leadership experience as a Chief Information Officer and Chief Technology Officer, with experience overseeing information security, risk management, and compliance functions. The Cybersecurity Steering Committee convenes no less than quarterly to evaluate and address significant risks stemming from cybersecurity threats.


text: Additionally, as part of its broader risk oversight, the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. As reflected in its charter, the Audit Committee is required to periodically review and receive reports from management regarding risks and exposures related to information technology and cyber security.


text: The Vice President of IT submits reports to the Audit Committee and other senior management members as appropriate. These reports provide insights into the evolving threat landscape, updates on the organization's cyber risks and threats, evaluations of the information security program, and the status of initiatives aimed at improving the information security program and its systems.


text: As an externally advised company, our day-to-day operations are managed by our adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior FS Investments professionals and our adviser is an affiliate of FS Investments. As such, we are reliant on FS Investments for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Our business is dependent on the communications and information systems of the adviser, as an affiliate of FS Investments. We also rely on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including us and our operations.


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cybersecurity risks applicable to us. The cybersecurity risk management program involves, among other things, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We rely on FS Investments to engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We are also included in the FS Investments risk management program and processes, which include cybersecurity risk assessments.


text: We depend on and engage various third parties, including suppliers, vendors and service providers, to operate our business. We rely on the expertise of the third-party risk management, legal, information technology and compliance personnel of the adviser and FS Investments, including the Chief Information Security Officer ("CISO"), of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: To date, cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: Board Oversight of Cybersecurity Risks The audit committee of the board of directors (the "Audit Committee"), provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and our Chief Compliance Officer ("CCO") regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology senior leadership, including the Chief Technology Officer;

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees our risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over 10 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as our CCO for over 10 years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to us.


text: Management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology and/or compliance personnel of the adviser and FS Investments.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect us, including our business strategy, operational results, and financial condition.


text: We have processes in place to identify, assess and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of FS/EIG Advisor, as an affiliate of FS Investments. We also rely on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including us and our operations.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess and manage cybersecurity risks applicable to us. The cybersecurity risk management program involves, among other things, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We depend on and engage various third parties, including suppliers, vendors and service providers, to operate our business. We rely on the expertise of the third-party risk management, legal, information technology and compliance personnel of FS/EIG Advisor and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The audit committee of the board of trustees, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and our Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology and/or compliance personnel of FS/EIG Advisor and FS Investments.


text: We recognize the critical importance of cybersecurity in protecting our business and our stakeholders' information. We are committed to maintaining a robust cybersecurity risk management program and implementing a comprehensive strategy to mitigate cyber threats and vulnerabilities. Our cybersecurity policies, standards, processes and practices are fully integrated into our overall enterprise risk management program, as described below. This disclosure outlines our cybersecurity risk management approach, strategy, and governance structure.

companyName: FORWARD AIR CORP

ticker: FWRD


text: The Board and the Audit Committee of the Board ("Audit Committee") are actively involved in oversight of our cybersecurity risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our security and the information that we collect as well as proactively identifying and preventing cybersecurity threats.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is focused on protecting critical assets, including data, systems and applications; minimizing the impact of cyberattacks; understanding and preparing for the evolving threat landscape and complying with applicable law. The program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board delegated oversight of cybersecurity risk management to the Audit Committee, which regularly interacts with our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including the Information Security Governance team and the Cybersecurity Risk Management team. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also continuously improving our cybersecurity program and maintaining a strong cybersecurity posture. Key to this approach is to broadly assess the potential impact of cybersecurity incidents on business operations and financial stability as well as any legal and regulatory requirements regarding cybersecurity. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection and prevention systems, encryption, access controls, secure coding practices and other security controls, which are regularly evaluated and improved through vulnerability assessments and penetration testing designed to identify weaknesses in our systems and networks. • Incident Response and Recovery Planning: We have a dedicated Incident Response Team dedicated to responding to and recovering from cybersecurity incidents. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including our vendors who handle our data and systems through due diligence and vendor assessments. • Education and Awareness: We provide regular, training for all employees and contractors, which is designed to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We regularly identify and assess cybersecurity risks through a comprehensive program that includes: • Vulnerability assessments and penetration testing: We conduct regular vulnerability assessments and penetration testing to identify and address weaknesses in our systems and networks. • Threat intelligence: We subscribe to threat intelligence feeds and maintain relationships with security partners to stay informed about emerging cyber threats. • Third-party risk assessments: We engage various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties to assist us in identifying, assessing and managing cybersecurity risks. We conduct initial and regular due diligence on third-party vendors who handle our data and systems. • Business impact analysis: We regularly assess the potential impact of cyberattacks on our business operations and financial stability. • Legal and regulatory risk assessment: We assess the legal and regulatory risks associated with cybersecurity incidents and ensure compliance with applicable laws and regulations.


text: As discussed above, our cybersecurity governance structure is integrated into several facets of us, which include: • Board of Directors: The Board has ultimate oversight responsibility for cybersecurity. The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures. • Audit Committee: The Audit Committee is responsible for monitoring the effectiveness of our information system controls and security, including a periodic review of our cybersecurity and other information technology risks, controls, initiatives and action plans. • Chief Information Security Officer (CISO): Casey O'Malley is our CISO and is responsible for the day-to-day management of the cybersecurity program. Casey has had a distinguished career holding IT management positions since 2015 and has been employed in the cybersecurity field since 2001. Casey holds a Bachelor of Science in Information Technology from Penn State University. • Information Security Governance: The Information Security Governance team is comprised of our senior executives and oversees the development and implementation of the cybersecurity strategy. • Cybersecurity Risk Management Team: The Cybersecurity Risk Management Team is responsible for identifying, assessing, and mitigating cybersecurity risks. • Incident Response Team: The Incident Response Team is responsible for responding to and recovering from cyberattacks.


text: The management team reports to the Board on cyber risk quarterly. Reports include: • Overall cybersecurity posture: Current state of our security controls and identified vulnerabilities. • Incident reports: Summary of recent cyber incidents, including their nature, impact, and mitigation efforts. • Risk assessments: Updated assessments of potential cyber threats and their potential impact on us. • Security budget and resource allocation: Plans and investments for maintaining and enhancing our cybersecurity program.


text: The management team is required to update the Board immediately once a material breach occurs. The Board is provided timely updates until the incident is considered resolved.


text: Management evaluates cyber incidents based on their materiality, considering factors such as: • Financial impact: Potential losses in revenue, profits, or assets. • Reputational damage: Impact on our brand image and customer trust. • Regulatory compliance concerns: Potential violations of data privacy regulations or other legal requirements. • Operational disruption: Impact on business continuity and ability to deliver services.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents have in the past affected our business. On December 15, 2020, we detected a ransomware incident (the "Ransomware Incident") impacting our operational and information technology systems, which caused service delays for our customers. We suffered unexpected costs and impacts from the Ransomware Incident and may in the future incur costs in connection with any future cybersecurity incidents, including infrastructure investments, remediation efforts and legal claims resulting from the above. It is reasonably likely to affect us, including our business strategy, results of operations or financial condition. For more information about our cybersecurity risks, see Item 1A, Risk Factors - "Our business is subject to cybersecurity risks."

stage1Category: Incident Disclosure


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Our information security function, which includes our Executive Director of Information Technology ("IT") and third-party service providers, helps identify, assess, and manage the Company's cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example conducting audits, evaluating threats, and performing vulnerability assessments.


text: Depending on the environment, systems, and data at issue, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, access controls, employee training, penetration testing, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Executive Director of IT, works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, penetration testing firms, and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and supply chain resources. We have a vendor management process to manage cybersecurity risks associated with our use of these providers. The process includes risk assessments for certain vendors and reviewing security assessments and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled: If our information technology systems or those third parties upon which we rely, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; material disruption of our product development programs; and other adverse consequences.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director of IT, who holds a Bachelor of Science in Computer Methods from California State University-Long Beach and has previously served as the Associate Director of IT for a large pharmaceutical company.


text: Our management, including our Chief Operating Officer and Executive Director of IT, is responsible for hiring appropriate information security personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and helping prepare for cybersecurity incidents.


text: we have prevented cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows.

companyName: Nakamoto Inc.

ticker: NAKA


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Executive Director of IT and General Counsel, who works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Board of Directors receives periodic reports from the management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. We also use security tools intended to protect our information systems from cybersecurity threats, and to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

companyName: Argo Group International Holdings, Inc.


text: In particular, our information security program and approach is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The NIST Framework establishes core requirements related to information protection, processes and technologies. In addition, we maintain a Data Protection Framework and various policies, including Information Security Policy, Privacy Policy, and Records & Information Management Policy, to appropriately manage personal information necessary to operate our business and comply with applicable regulations. We also maintain a Third-Party Risk Management Program, including a Vendor Management Policy, which allows us to better oversee, monitor, identify and control certain risks related to the processing of personal information and customer information by our authorized third parties.


text: In accordance with these policies, we share personal information with affiliates, business partners, third-party service providers, or vendors only when we have a legitimate business purpose for doing so and it is permissible by law. We require third parties to maintain similar standards to ours to protect personal information. We have implemented a risk mitigation process to identify and assess the cyber posture of third parties providing commodities or services to our legal entities. We also have implemented multiple layers of data protection measures.


text: We have in the past, and may in the future, engage third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. As part of continuous improvement initiative, we strive to mature and build a robust and resilient environment to protect and defend against bad actors. We engage third parties to perform internal and external testing to improve security operations, disaster recovery, and incident response programs.


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Refer to the risk factors under "Operational Risks" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.