text: Although we develop and maintain processes and tools designed to prevent cybersecurity threats from occurring, and to identify and mitigate threats, the possibility of these events occurring cannot be eliminated entirely. As we engage in more electronic transactions, rely more on cloud-based information systems, and utilize outside vendors or service providers that have access to our electronic information, the related security risks will increase, and we will likely need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our information technology systems will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including because of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: XBiotech Inc.

ticker: XBIT

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: majority


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity attack or incident, such as a data breach, ransomware, malware, phishing, or other form of cybercrime, could adversely affect our operations, customer service, product development, and competitive position. Such incidents may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. They could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.

companyName: PSYCHEMEDICS CORP

ticker: PMDI


text: Cybersecurity Incident Response Plan. We maintain a comprehensive incident response plan designed to mitigate the impact of a cybersecurity incident. This plan includes protocols for internal response, external communication, and remediation efforts to minimize the impact on our operations and stakeholders.

companyName: Axe Compute Inc.

ticker: AGPU


text: At Psychemedics, the Vice President of Information Technology also serves in a dual capacity as the Chief Information Security Officer (VPIT & CISO) overseeing our information security program. The VPIT & CISO's team is tasked with the development and implementation of cybersecurity strategy, policy, standards, architecture, and processes. Our cybersecurity program is aligned with industry standards and best practices, such as the CIS Critical Security Controls ("CIS 18") Implementation Group 1 ("IG1") guidelines. We maintain an incident response and recovery plan, including measures for responding to and recovering from cybersecurity incidents. To minimize the threat surface, we strategically limit the use of third-party service providers with access to personal, confidential, or proprietary information. Also, we evaluate these providers and take steps to help mitigate risks associated with their use and minimize the potential for supply chain attacks. Employing a risk-based approach, we are committed to continuously reassessing our cybersecurity posture and improving our defenses in response to evolving and emerging threats. While we have not experienced any known material incident in the past year, we acknowledge that we have limited resources dedicated to identifying and mitigating cybersecurity risks and that an information security plan is not infallible.


text: At least twice each calendar year, the VPIT & CISO will report on the health and status of our information security program to our Board of Directors, or a committee thereof, as well as to our Chief Executive Officer and other members of our senior management as appropriate. These reports typically include a high-level overview of current and emerging cybersecurity risks; an assessment of the organization's overall security posture; incident reports; an update on our compliance with relevant cybersecurity laws, regulations, and standards; an overview of ongoing and planned initiatives to strengthen the organization's cybersecurity defenses; and strategic recommendations.


text: Risk Management and Strategy As an active participant in the biopharmaceutical industry, our company operates within a landscape fraught with diverse cybersecurity risks. These risks have the potential to significantly impact our business, financial standing, and operational outcomes.

companyName: BeyondSpring Inc.

ticker: BYSI

stage1Category: None/Other

stage1Method: unanimous


text: Our partnership with a trusted third-party service provider stands as a pivotal pillar in our cybersecurity strategy. Leveraging their expertise, they have crafted and implemented 58 automated lockdown policies, each strategically designed to create safeguards around our digital infrastructure. These policies serve as a sophisticated array of safeguards, actively working to thwart potential breaches before they can even manifest. Moreover, their commitment to our security extends to continuous monitoring measures that operate round-the-clock. This proactive surveillance ensures that any anomalies or suspicious activities are swiftly identified and addressed, minimizing the window of vulnerability.

stage1Category: Risk Management Process


text: Complementing this arsenal is the deployment of an EDR (Endpoint Detection and Response) agent, a cutting-edge technology that places us at the forefront of cybersecurity innovation. This agent is not merely a passive observer; it is our vigilant sentinel, constantly scanning and analyzing our network for any aberrations or patterns indicative of cyber threats. Through real-time monitoring, it provides us with invaluable insights into our system's health, promptly flagging any deviations from the norm.


text: Within our own operations, we uphold a culture of uncompromising security standards. To enhance access controls, we have implemented robust multifactor authentication methods for all personnel accessing our SharePoint and Outlook software. This additional layer of authentication not only bolsters our defenses but also ensures that only authorized individuals can gain entry to sensitive information. Moreover, our stringent email sign-in blocking policy exemplifies our proactive stance towards security. This policy is particularly pivotal during employee transitions, where the potential for security lapses is heightened. Upon an employee's departure, our Outlook administrators promptly deactivate their email sign-in functionalities, mitigating any risks associated with unauthorized access. These measures collectively form a cohesive and dynamic security framework, safeguarding our assets and ensuring the integrity of our operations in an increasingly digital landscape.


text: The Board of Directors oversees risks stemming from cybersecurity threats. Their strategic guidance and informed decisions serve as the cornerstone of our cybersecurity framework. Complementing this oversight, our third-party IT vendor plays a pivotal role in the implementation of comprehensive company-wide cybersecurity policies. Beyond this, they are entrusted with the deployment and management of critical protective software, serving as our frontline defenders against evolving cyber threats. To ensure seamless communication and swift action, they maintain a direct reporting line to the company's IT administrator. This structured reporting mechanism enables prompt notification and collaborative response to any detections or anomalies, fostering a proactive and vigilant stance towards safeguarding our digital assets and operations.

stage1Category: Third-Party Risk


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board exercises oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are integrated into our ERM program and are based on frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: We engage in the periodic assessment and testing of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a range of activities, including audits, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board receives reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Senior Director of IT and Cybersecurity, in coordination with our executive officers, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, the Company's internal IT team is deployed to work with business functions across the Company to address cybersecurity threats and to respond to cybersecurity incidents. The Senior Director of IT and Cybersecurity, as leader of the internal IT team, monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the executive officers and Board when appropriate.


text: The Senior Director of IT and Cybersecurity has served in various roles in information technology and information security for more than two decades with a track record of managing systems compliant with relevant security standards. The Senior Director of IT and Cybersecurity has industry experience and education aligned with the Company's work and the data we maintain. The Senior Director of IT and Cybersecurity's expertise is complemented by that of the Company's CEO and Interim CFO, each with degrees in their respective fields and extensive leadership experience including experience managing risks at similar companies.


text: We face a number of cybersecurity risks in connection with our business. Such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date. For more information about the cybersecurity risks we face, see the risk factor entitled " Security breaches, loss of data, and other disruptions to our business or the business of our third-party service providers could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and reputation. " in Item 1A. Risk Factors.


text: The Company's cybersecurity risk management program is integrated into our enterprise risk management program and is designed to expeditiously identify, analyze and protect against security threats to its computer systems, software, networks, storage devices and other technology assets. Our management team, with input from our Board of Directors, proactively manages the Company's cybersecurity risks to avoid or minimize the impacts of attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt service, sabotage systems or cause other damage. Specifically, the Company has appointed a Chief Information Officer ("CIO") to maintain a comprehensive information security program. Our strategy includes a continuous improvement mindset along with a defense in depth approach to cybersecurity. Our layered security architecture consists of innovative technology to detect, prevent, and mitigate cybersecurity threats. Ongoing proactive analysis of cyber threat intelligence ensures that we are taking the appropriate counter measures to defend against the latest threats. We use monitoring and preventive controls to detect and respond swiftly to data breaches and cyber threats involving our systems. We regularly evaluate our systems and controls and implement upgrades as necessary. This includes regular consultation with external cybersecurity experts. In addition, we participate in external tabletop exercises on a regular basis in addition to conducting our own internal tests of our systems. We also attempt to reduce our exposure to our vendors' data privacy and cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions. The additional cost to us of data and cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third-party technology providers, consulting and testing firms, insurance premium costs, legal fees and the cost of personnel who focus a substantial portion of their responsibilities on data security and cybersecurity.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: The Company uses a Disaster Recovery Plan (the "Plan"), along with incident response policies, to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Company and with our Board of Directors, notify law enforcement, regulatory bodies, and other government agencies, and notify customers and employees. The Plan provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team ("CMT"). The CMT facilitates coordination across key stakeholders of the Company. The Company's CIO and key members of management are members of the CMT. The Company provides the CIO and the information security team the latest tools and techniques to protect the confidentiality, integrity and availability of the Company's data for the benefit of our customers, employees and shareholders. We regularly engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities specifically include internal audits, vulnerability assessments and penetration testing. The Company's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives. The CIO and other members of the information technology team receive ongoing training related to developing threats, proactive solutions and industry best practices in order to effectively protect the Company and its stakeholders.


text: The Company maintains a third-party risk management program designed to identify, analyze and monitor risks, including cybersecurity risks, associated with vendors and outside service providers. Our vendor risk management team collaborates closely with the information security team to ensure third parties meet certain information security control requirements. Our information security team proactively monitors our internal systems and email gateways for phishing email attacks. Remote connections are also assessed and monitored given a portion of our workforce works remotely. Personnel serve as members of both teams helping to effectively identify and communicate issues as they develop.


text: Our Board of Directors provides direction and oversight over the Company's enterprise-wide risk management program, including risks related to cybersecurity. The entire Board of Directors is provided regular updates regarding the Company's information technology policies, procedures, risks and operating status. These updates include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Cybersecurity incidents are managed through the Plan, and other appropriate response policies, which provide direction to management allowing for the timely transfer of information throughout the organization. Our policy requires material incidents to be reported within 36 hours after an incident is determined to be material with the materiality determination to be completed without unreasonable delay. The CMT has developed a plan to facilitate making timely determinations as to whether and when incidents should be disclosed. If a material incident occurs, the Company will describe in detail the material aspects and nature, scope and timing of the incident, along with the impact to its financial condition and results of operations via the timely filing of Form 8-K.


text: To our knowledge, previous cybersecurity incidents have not materially affected the Company, its business strategy, financial condition or results of operation. With regard to the possible impact of future cybersecurity threats or incidents, see "Item 1A. Risk Factors."


text: We face risks associated with cybersecurity. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors - The occurrence of security breaches and cyber-attacks could negatively impact our business." and "- Privacy and data security concerns, laws, or other regulations could expose us to liability or impair our operations.."

companyName: ZW Data Action Technologies Inc.

ticker: CNET


text: The purpose of our cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of our business objectives. Under our comprehensive risk management program, the Board of Directors of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to our business, corresponding risk-mitigation efforts and day-to-day management of our risk management program. The full Board of Directors retains oversight over management's cybersecurity efforts. At least annually, and often more frequently, our Board of Directors receives cybersecurity briefings from senior executives, including, when appropriate, executives focused on cybersecurity matters.


text: Our companywide cybersecurity policy sets the framework for our approach to cybersecurity. Each business unit and our corporate headquarters designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under our approach to cybersecurity, each business unit designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. Our cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter. Our policies and procedures are also designed to oversee and identify material cybersecurity risks related to third-party vendors and service providers.


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support the assessment of cyber related risks, including to conduct cyber penetration testing.


text: To its knowledge, the Company has not experienced a material cybersecurity breach within the last three years, nor identified any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition.


text: The Company does not currently have formal processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our approach to cybersecurity is currently informal and primarily reactive, involving basic security measures such as: Basic Security Software: We use standard antivirus and anti-malware software for protection against common threats. Password Policies: Simple password policies are in place to protect access to our systems.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: We have integrated governance processes into our overall risk management framework to enable the Board of Directors to oversee cybersecurity risk. The Audit Committee oversees management's policies and procedures related to cybersecurity risk management and periodically reports to the Board of Directors. The Chairman of the Audit Committee acts as the lead with respect to direct oversight of management.

companyName: FIVE BELOW, INC

ticker: FIVE


text: Reliance on the security systems of our service providers: We utilize the services of various providers for items such as intellectual property management, payroll, and accounting, and rely on their systems to prevent or detect cybersecurity threats and incidents. Develop a Cybersecurity Framework: Establish a formal risk assessment process to identify vulnerabilities. Engage Cybersecurity Expertise: Consider hiring or consulting with cybersecurity professionals to guide our strategy.


text: We acknowledge that the absence of comprehensive cybersecurity processes could potentially expose the company to risks, which may materially affect our operations, financial condition, or strategic decisions in the future. We are committed to improving our cybersecurity posture as our resources allow.


text: Board Oversight: Currently, our directors do not have a formal structure for overseeing cybersecurity risks. We plan to review this oversight in the near future to ensure appropriate governance is established.

stage1Category: Board Governance


text: Management's Role: Day-to-day management of cybersecurity is handled by our Chief Executive Officer ("CEO"), who does not have specialized training in cybersecurity. We are considering enhancing this role or outsourcing to professionals with specific cybersecurity expertise.

stage1Category: Management Role


text: Expertise: Our current management and Board do not have in-depth cybersecurity expertise. We are considering educational opportunities or consulting to address this gap.


text: Material Effect from Cybersecurity Threats To date, no known cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, due to our limited cybersecurity measures, we acknowledge that our company could be at higher risk of material impact from cybersecurity threats.


text: Cybersecurity, data privacy, and data protection are critical to NTIC's business. In the ordinary course of business, NTIC collects and stores certain confidential information, such as information about employees, contractors, vendors, customers, and suppliers. NTIC has processes in place for assessing, identifying, and managing material risks from cybersecurity threats, and NTIC regularly assesses its performance and identifies areas for improvement. NTIC also has implemented measures to safeguard its entire cyber network. Management continually re-assesses NTIC's cybersecurity risk environment based on changing circumstances and new information identified by monitoring, scanning and testing its systems, as well as utilizing third party resources for testing.

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: Risk Management and Strategy NTIC's processes for assessing, identifying, and managing cybersecurity threats have been integrated into its overall risk management processes. The information provided by these processes facilitates management's ongoing assessment of NTIC's cybersecurity risk environment and provides current and accurate information regarding cybersecurity risks to management, the Audit Committee and Board of Directors to allow appropriate management of such risks through remediation or other risk mitigation activities.


text: NTIC maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. NTIC takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect its operations, finances, legal or regulatory compliance, or reputation. The scope of NTIC's evaluation encompasses risks that may be associated with both its internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and employee training, education, and awareness initiatives.


text: Role of Management Management has implemented risk management structures, policies, and procedures and is responsible for NTIC's day-to-day cybersecurity risk management. NTIC's Information Technology Director, who possesses a strong foundation in cybersecurity through prior managerial experience and specialized training, oversees the daily assessment and management of cybersecurity risks. NTIC employs best practices, including real-time monitoring, anti-virus protection, and ongoing patch management across all systems. System maintenance is performed in accordance with industry standards and aligned with recognized best practices. Because cybersecurity threats continue to evolve, NTIC's implemented measures are designed to be flexible and adaptable to respond to changes in the security landscape. The following security measures give some insight as to what has been implemented: Multifactor authentication Phishing simulations User permissions auditing and tightening Proactive blocking of high-risk email Active monitoring of user sign-in On-premises endpoint reduction Endpoint detection and response Licensing, network, and hardware compliance management


text: Use of Consultants and Advisors NTIC engages various third-party cybersecurity service providers to assess and enhance its cybersecurity practices and assist with protection and monitoring of its systems and information, including with respect to protection of its e-mail, system access, network monitoring, endpoint protection, vulnerability assessments, and penetration testing. NTIC engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices, such as a third party consulting firm to perform tabletop exercises and evaluate NTIC's cyber processes, including an assessment of its incident response procedures.


text: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, oversees the proper functioning of NTIC's cybersecurity risk management program. In particular, the Audit Committee, which is comprised entirely of independent directors, is responsible for reviewing and discussing guidelines and policies governing the process by which senior management of NTIC assesses and manages NTIC's exposure to risk and reviewing and discussing NTIC's major financial risk exposures, including cybersecurity risk, and the steps management has taken to monitor and control such exposures; it being understood that it is the job of management to assess and management NTIC's exposure to risk and that the Audit Committee's responsibility is to discuss guidelines and policies by which risk assessment and management are undertaken. The Audit Committee additionally receives periodic updates from senior management on NTIC's policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of cybersecurity risks and is responsible for reviewing the cybersecurity disclosures required to be included in NTIC's SEC filings.


text: Although none of the members of the Audit Committee has any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee works closely with members of management and NTIC has engaged third-party service providers to further enhance its cybersecurity efforts and the oversight thereof by the Audit Committee.


text: Risks from Material Cybersecurity Threats Although NTIC has taken steps to prevent and mitigate data security threats, there can be no assurance that its protective measures and those of its third party service providers will prevent or detect security breaches that could have a significant impact on NTIC's business, reputation, operating results and financial condition. NTIC maintains cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of NTIC's systems. As of the date of this filing, NTIC has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on NTIC's business strategy, results of operations or financial condition. Although NTIC has not experienced cybersecurity incidents that are individually, or in the aggregate, material, NTIC has experienced cyberattacks in the past, which NTIC believes have thus far been mitigated by preventative, detective, and responsive measures it has put in place. See the factors described in the " Part I. Item 1.A. Risk Factors " section of this Form 10-K for further detail about the cybersecurity risks NTIC faces. Maintaining a robust information security system is an ongoing priority for NTIC, and NTIC plans to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within NTIC and through its engagement of third-party service providers.


text: Risk Management and Strategy We believe cybersecurity plays a strategic role in ensuring smooth business operations. We are committed to developing, implementing and maintaining cybersecurity measures and processes that are designed to safeguard our information systems, data and operations, and to assess, identify and manage cybersecurity threats that may impact our business.

companyName: Clearfield, Inc.

ticker: CLFD


text: We operationalize our cybersecurity program through an information security management system based on the ISO/IEC 27001:2022 standard. This does not imply that we meet any particular technical standards, specifications, or requirements - only that we use the ISO/IEC 27001:2022 standard as a guide in designing and implementing our cybersecurity program. We believe designing and building our cybersecurity program around best practices and principles helps support robust business continuity.


text: Our cybersecurity program is integrated into our overall risk management processes. Key elements of our cybersecurity risk management program include, among others: Ongoing cybersecurity training and testing for all employees; Regular patching, vulnerability scanning, penetration testing, and network monitoring; Robust IT infrastructure to help reduce opportunities for adverse exploitation; Operational processes that reinforce cybersecurity policies and IT controls; Regular audits to assess our cybersecurity posture, maturity, and progress;


text: A cybersecurity incident response plan operationalized in a governance, risk, and compliance ("GRC") platform; and A third-party risk management process for enterprise software vendors that includes reviewing System and Organization Control 1 and 2 (SOC 1 and SOC 2) reports and onboarding and maintenance processes for suppliers that include cybersecurity assessments.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date we have not experienced any cybersecurity incidents that have materially affected our business strategy, financial condition, or results of operations. The cybersecurity threat landscape continues to evolve and escalate. We are subject to ongoing risks from cybersecurity threats that could materially affect our business strategy, financial condition, or results of operations, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Our Board of Directors includes cybersecurity risk as part of its overall risk oversight function, and has delegated to our Audit Committee responsibility for overseeing, reviewing and discussing with management: (i) our cybersecurity, information technology and data security risks and threats; (ii) the potential impact of those risks and threats on our business, operations, and reputation; and (iii) management's processes, procedures and actions to identify, assess, monitor, mitigate, and remediate such risks and threats. Our Chief Information Officer, who reports to our Chief Executive Officer, provides the Board and the Audit Committee regular reports and assessments on our cybersecurity program and material cybersecurity risks. In addition, our Chief Information Officer updates the Board and the Audit Committee, as appropriate, regarding significant cybersecurity incidents should they occur.


text: A cybersecurity incidence response team comprised of key function heads and personnel, including IT, Finance, Legal, and Human Resources, provides operational support for clarifying and acting on cybersecurity issues, including decision-making around materiality, escalation and disclosure. Our cybersecurity program is principally managed by our Information Security Manager, who reports to our Chief Information Officer. Together, our Information Security Manager and our Chief Information Officer have over 50 years of experience in IT, including developing, implementing, and operating IT controls. Our Chief Information Officer and our Information Security Manager manage cybersecurity risks by continually working to reduce risks, respond appropriately to incidents, and invest in hardening our attack surface to improve our cybersecurity posture. Our GRC platform is designed to provide reliability in identifying, tracking, and mitigating cybersecurity risks. We also engage third party assessors, consultants, and auditors to extend internal team capabilities and support our cybersecurity program, including engaging a cybersecurity service provider that provides 24/7 continuous managed detection and response services.


text: Risk Management and Strategy In the ordinary course of our business, we, and third parties upon which we rely, collect, use, store and transmit confidential, sensitive, proprietary, personal and protected health information. The secure maintenance of this information is important to our operations and business strategy. To this end, we have implemented various cybersecurity plans and processes designed to manage cybersecurity risks relating to our third party hosted services, communications systems, hardware and software, and our critical data, including data related to our clinical trials and investigational products.

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: One of our strategies to mitigate cybersecurity risks is to utilize expert third-party software-as-a-service, human resource, and clinical providers to store and manage personally identifiable information, rather than maintaining and processing such data within our enterprise. We select reliable, reputable service providers that maintain cybersecurity programs of their own and other measures to comply with privacy and security requirements, including when applicable Canada's Personal Information Protection and Electronic Document Act ("PIPEDA") and the U.S. Health Insurance Portability and Accountability Act ("HIPAA"). Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, we may also contractually impose certain security obligations on the provider.


text: Our executive leadership exerts operational oversight of our cybersecurity as part of our overall risk management function. We engage an expert IT and security provider to assist us with managing security risk and responding to cybersecurity threats or incidents. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and utilize back-up and recovery systems where appropriate. We also use other technology-based tools that are designed to mitigate and detect cybersecurity risks. In addition, we provide our employees with cybersecurity training, including topics such as phishing, password protection and reporting cyber incidents.


text: Our Board oversees our risk management strategy with respect to cybersecurity threats. The Board, through its audit committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our executive leadership and security provider, concerning our cybersecurity risk management activities, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. Management also notifies the audit committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as appropriate.


text: Material Effects of Cybersecurity Incidents As of the date of this report, we have not identified any cybersecurity event or risks from cybersecurity threats that, individually or in the aggregate, would materially affect us. Notwithstanding, we, or third parties upon which we relay, may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us or our business strategy, results of operations or financial condition. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology, including, without limitation, the risk factor under the heading "We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively"


text: The Audit Committee meets on a quarterly basis. A set agenda of risk matters includes detailed updates of the Company's preparedness and significant cybersecurity activities. The topics covered by these updates have included discussions of policies and procedures to prevent, detect and respond to cybersecurity incidents, modifications to on-line platforms, and the use of cloud-based applications. Lessons learned from cybersecurity incidents and the internal and external testing of our cyber defenses are provided quarterly. The Board is also provided with an annual cybersecurity technology risk and control update.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: The Company has implemented a cybersecurity program that oversees, assesses, and manages its cybersecurity risks. As a component of the Company's formal enterprise risk management program, whose goal is to support the business objectives and strategy, the cybersecurity program leverages multiple security measures to protect the integrity of the Company's information assets. The program's strategy aligns to the National Institute of Standards and Technology Cybersecurity Control Framework, where controls are implemented throughout our environment to achieve five categorical objectives of a cybersecurity program, including identification, protection, detection, response, and recovery.


text: Our cybersecurity program is regularly assessed to ensure it meets the ever-changing cyber risk environment. This is accomplished via monthly risk assessment meetings performed by our technical cybersecurity committee, periodic risk assessments and audits performed by internal audit, and cyber tests and assessments performed by contracted consultants.


text: Our cybersecurity program includes several methods to protect against intrusion by a bad actor, including such techniques as reputational filtering, anti-virus scans, intrusion prevention, multi-factor authentication, and account isolation among others. We also use numerous approaches to detect ransomware and other cyber-attacks, including among others, dark web searches, email sandboxing, endpoint detection, and intrusion detection. The Company continuously monitors and enhances its program to respond to evolving cyber threats and changes in the regulatory environment.


text: To ensure the effectiveness of the cybersecurity program, we have implemented various assurance methods including ongoing internal audit control reviews, external reviews by third-party consultants including penetration testing, and cyber incident response team exercises. Ongoing monitoring of our systems and security metric reviews are in place to manage external threats. Our cyber monitoring and supporting metrics include such areas as intrusion detection, phishing attempts, cyber training results, and patch management vulnerabilities. Additionally, the Company collaborates with industry associations, government authorities, peers, and external advisors to monitor the threat environment to ensure no gaps exist in our security practices.


text: A third-party risk management program is in place ensuring those risks associated with our use of vendors to support our business objectives and strategic initiatives are properly understood and mitigated. Through management's oversight, third-party assessments of vendor's information security practices and protocols, including their readiness to protect against and respond to cybersecurity breaches are performed. Third-party service providers are categorized into tiers in consideration of the risk of a vendor's activities. Vendor due diligence questionnaires are issued seeking to understand a service provider's cyber and information security control environment, as well as their resiliency in the event of an intrusion to their systems. Formalized vendor incident response procedures are in place that support the activities required should a cyber event occur.


text: We continue to improve our ability to defend against, respond to, and recover from ransomware and other cyber events; enhance application cybersecurity capabilities, including defenses against fraud attacks; and to ensure security capabilities are built into new cloud-based platforms that we adopt. We are also required to maintain strong cyber defense protocols in the states where we are authorized or licensed to write business. We monitor the status of new cybersecurity regulations, including notification requirements.


text: To the best knowledge of management, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Our Board is ultimately responsible for the oversight of risk management strategy, business plan and management of financial resources. As part of these responsibilities, the Board is apprised, annually and as needed, of developments in the external environment and business strategies that present increased cyber risk exposure to the Company. On a weekly basis, The Vice President of Management Information Services ("VP of MIS") meets with the Chairman of the Board of Directors, President and Chief Executive Officer ("Chairman, President and CEO"), to discuss developments with the Company's IT environment, including its cybersecurity program. The Chairman, President and CEO would then inform the Board of those developments, as needed. The Board has delegated oversight of cybersecurity risk management to the Audit Committee of the Board of Directors.


text: The processes by which our Senior Director, Information Protection & Compliance and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: bimonthly management committee on cybersecurity meetings, formal e-mail notifications, and CIO updates as part of regular Executive Officer meetings.

companyName: HAWAIIAN HOLDINGS INC


text: A management level risk committee exists and oversees the management of the Company's highest-level risks, including cybersecurity. This committee consists of representatives from the Risk, Financial, Underwriting, Information Technology and Legal Departments. The Risk Committee, as supported by the Cybersecurity Committee, is responsible for keeping the audit committee apprised of the Company's cybersecurity preparedness and cyber incidents. The Cybersecurity Committee oversees and ensures the Company's cyber-related controls are sufficient to protect the Company's information and proprietary assets, in accordance with the acceptable risk policies and risk tolerances.


text: The VP of MIS has expertise assessing and managing cybersecurity risks, and is a member of both the Risk Committee and Cybersecurity Committee. He has served in his current role since 2014 and has held several senior-level information technology roles in his 31-year tenure with the Company. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.


text: The VP of MIS has expertise assessing and managing cybersecurity risks, and is a member of both the Risk Committee and Cybersecurity Committee. He has served in his current role since 2014 and has held several senior-level information technology roles in his 32-year tenure with the Company. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct annual risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Senior Director, Information Protection & Compliance, who reports to our Chief Information Officer (CIO), to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards, including through the use of automated tools and manual processes, such as vulnerability scanning, penetration tests, and assessments of our technology infrastructure, and regularly train our employees on these safeguards, in collaboration with management, including phishing tests and third party training modules.


text: We engage assessors, consultants and other third parties in connection with our risk assessment processes. These service providers review our cybersecurity policies, procedures and safeguards and provide feedback to increase the effectiveness of our cybersecurity controls.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled, "Our actual or perceived failure to protect consumer information or other personal information or confidential information could result in harm to our business."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors oversees our cybersecurity risk management. The Company's Audit and Finance Committee periodically reviews with management the Company's operational risk exposure related to cybersecurity and information technology and the steps management has taken to monitor and control these exposures, including the Company's related guidelines and policies.


text: Our Senior Director, Information Protection & Compliance directly oversees our information security team and has over twenty years of experience in the information security industry and industry certifications, including Certified Information Systems Security Professional and Certified Information Security Manager. Our Senior Director, Information Protection & Compliance and our management committee on cybersecurity, which includes our Chief Executive Officer, Chief Operating Officer, Chief Legal Officer, and CIO are primarily responsible to assess and manage our material risks from cybersecurity threats. This same group oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above.


text: Our Board of Directors considers cybersecurity risks through interaction with our management team and the Audit Committee, as well as through quarterly updates with our CISO.


text: Our management team provides the Audit and Finance Committee with quarterly briefings regarding enterprise risks, and reviews enterprise risks with the Board of Directors on an annual basis. Cybersecurity risks are included in these reviews, and our Senior Director, Information Protection & Compliance, CIO and representatives from our management committee on cybersecurity periodically provide more detailed cybersecurity-focused briefings to the Audit and Finance Committee and Board of Directors regarding cybersecurity risks and activities, including notable recent cybersecurity incidents and related responses.


text: The Company's Board of Directors, directly and through its committees, is responsible for overseeing cybersecurity risks that affect the Company. As such, the Board has delegated oversight of risks related to cybersecurity to the Audit Review Committee of the Board of Directors (the "ARC"). The ARC is charged with reviewing the Company's cybersecurity risks, controls and procedures. The ARC reviews the Company's plans to mitigate cybersecurity risks and the Company's ability to respond to and remediate cybersecurity incidents. The ARC is informed of such risks through regular reviews with management regarding any specific cybersecurity issues that could affect the adequacy of internal controls over financial reporting.

companyName: HYSTER-YALE, INC.

ticker: HY


text: The Company's cybersecurity risk management processes are a component of the Company's overall risk management program. The Company's Cybersecurity Committee (the "CSC") oversees the establishment and operations of cybersecurity risk management processes and strategies and directs activities to identify and detect cybersecurity threats, protect the Company's assets and to respond and recover from cybersecurity incidents. The CSC is responsible for coordination with the Company's internal audit, risk management and/or crisis management teams to review and respond to cybersecurity threats.


text: The CSC is chaired by a member of the Office of the Chief Information Security Officer ("Office of the CISO") and includes members of senior management from operations, finance and legal. The CSC is expected to meet quarterly. In coordination with the Office of the CISO, the CSC reviews and reports on the Company's cybersecurity activities to the ARC on a quarterly basis and to the full Board of Directors on at least an annual basis.


text: The CSC works with the Company's Office of the CISO, which is responsible for the daily direction of cybersecurity risk activities. The Office of the CISO uses various data protection frameworks and conducts vulnerability assessments, cybersecurity monitoring and recovery software, employee, supplier and dealer training programs and monitoring of incidents and threats. Members of the Office of the CISO also engage with the Company's internal audit department to review cybersecurity threats focusing on operational applications and databases through the course of their activities. The Office of the CISO consists of the Director of Cybersecurity, the Chief Information Officer and other information technology and cybersecurity specialists. The Office of the CISO has extensive experience in information technology including roles in cybersecurity, privacy, software engineering, systems engineering, infrastructure and data center management.


text: In addition, the Company engages third parties to assist in assessing, enhancing, implementing and monitoring the Company's cybersecurity risk-management programs. The Company maintains processes to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.


text: The Company has experienced cybersecurity threats and vulnerabilities in its information systems and those of third-party providers. Such prior events have not had a material impact on the Company's financial condition, results of operations or liquidity. If, in the future, the Company's or a third-party provider's information systems suffer severe damage, disruption, breach, or shutdown, and business continuity plans do not effectively resolve the issues in a timely manner, then the Company could be subject to litigation with third parties, government enforcement actions, penalties, disruption to operations and product systems, unauthorized release of confidential or otherwise protected information, corruption of data or remediation costs, which could materially adversely affect the Company's operating results, financial position or reputation. See "Risks Related to Cybersecurity" in "Risk Factors" beginning on page 11 of this Annual Report on Form 10-K.


text: The Company's cybersecurity risk management processes are a component of the Company's overall risk management program. The Company's Board of Directors, directly and through its committees, is responsible for overseeing cybersecurity risks that affect the Company. As such, the Board has delegated oversight of risks related to cybersecurity to the Audit Review Committee of the Board of Directors (the "ARC"). The ARC is charged with reviewing the Company's cybersecurity risks, controls and procedures. The ARC reviews the Company's plans to mitigate cybersecurity risks and the Company's ability to respond to and remediate cybersecurity incidents. The ARC is informed of such risks through regular reviews with management regarding any specific cybersecurity issues that could affect the adequacy of internal controls over financial reporting.


text: The management Info Sec Steering Committee provides oversight and governance of the Information Security Program. This committee includes members of information security, risk, compliance, audit, human resources, legal, operations, banking, and wealth. The committee generally meets monthly to review and provide oversight of our risk management strategy; audit reports related to our cyber and information security processes; third-party risk assessments; periodic testing of systems and infrastructure; status of employee and customer training; and updates on security incidents. More frequent meetings may occur in accordance with the incident response plan to facilitate timely assessment, monitoring, and reporting.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: The Company's Office of the Chief Information Security Officer ("Office of the CISO"), which is responsible for the daily direction and management of cybersecurity risk activities, consists of the Chief Information Security Officer, Chief Information and Digital Officer and other information technology and cybersecurity specialists. The Office of the CISO uses various data protection frameworks and conducts vulnerability assessments, cybersecurity monitoring and recovery software, employee, supplier and dealer training programs and monitoring of incidents and threats. Members of the Office of the CISO also engage with the Company's internal audit department to review cybersecurity threats focusing on operational applications and databases through the course of their activities. The Chief Information Security Officer has extensive experience in information technology including roles in cybersecurity, privacy, software engineering, systems engineering, infrastructure and data center management, and is a Certified Information Security Manager and a Certified Data Privacy Solutions Engineer.


text: The Company's Office of the CISO chairs the Company's Cybersecurity Committee (the "CSC"), which oversees the establishment and operations of cybersecurity risk management processes and strategies and directs activities to identify, detect, assess and manage risks from cybersecurity threats, protect the Company's assets and to respond and recover from cybersecurity incidents. The CSC is responsible for coordination with the Company's internal audit, risk management and/or crisis management teams to review and respond to cybersecurity threats. The CSC includes members of senior management from operations, finance and legal. The CSC is expected to meet quarterly. On behalf of the CSC, the Office of the CISO review and reports on the Company's cybersecurity activities to the ARC on a quarterly basis and to the full Board of Directors on at least an annual basis.


text: The Company has experienced cybersecurity threats, cybersecurity incidents and vulnerabilities in its information systems and those of third-party business partners. As of the date of this filing, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have had or are reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. If, in the future, the Company's or a third party's information systems suffer severe damage, disruption, breach, or shutdown, and business continuity plans do not effectively resolve the issues in a timely manner, then the Company could be subject to litigation including individual claims or consumer class actions, commercial litigation, administrative, civil or criminal investigations or actions, regulatory intervention, government enforcement actions, penalties, sanctions or fines, disruption to operations and product systems, unauthorized release of confidential or otherwise protected information, corruption or alteration of data, payment of ransom, or investigation and remediation costs, which could result in a negative impact on the Company's business strategy, results of operations, financial condition or reputation. See "Risks Related to Cybersecurity" in Part I, Item 1A. Risk Factors, in this Annual Report on Form 10-K.


text: Risk Management and Strategy Nicolet is susceptible to information security breaches and cybersecurity-related incidents like any other entity. Risks related to cybersecurity attacks are expected to remain heightened as digital capabilities continue to evolve. Increasing use in digital platforms create a vast footprint for sophisticated threats to attack organizations internally and externally, blurring the outermost edge of security. To mitigate these risks, resources are employed to provide visibility, prevention, and mitigation strategies, in line with information security standards.


text: Our management IT Steering Committee has established an Information Security Program, which includes appropriate security risk assessments, security monitoring, incident response, policies, operating standards, compliance, and employee training. The underlying controls of this security program are based on the guidelines and frameworks provided by the Office of the Comptroller of the Currency (the "OCC"), the Federal Financial Institutions Examination Council (the "FFIEC"), and the National Institute of Standards and Technology ("NIST"), as well as industry best practices and standards. The Information Security Program focuses on the following key areas: • IT Governance, Risk & Compliance – As discussed in further detail under the "Governance" section below, we have established programs, policies, and procedures for security oversight, including risk assessments for business processes and applications. These cyber and information security programs, policies and procedures are reviewed annually by a third-party. • Identity & Access Management – We have established controls to mitigate risks related to unauthorized access, identity theft, and data breaches. Process and technology controls include identity, authentication, authorization, account management, and access, along with monitoring and logging for tracking events. • Security Architecture & Engineering – Our security is tailored around industry best practices and guidance. This establishes the foundation for secure resilient systems that can withstand and mitigate cyber risks effectively. • Security Operations – We use various tools to assess, monitor, and analyze the vulnerability of our operating systems, and have established an incident response plan for addressing identified threats and incidents. • Resiliency, Safety & Security – We have established policies and procedures to withstand and recover from disruption, protect our people and environment, as well as protect our systems and information from threats and unauthorized access. • Vendor Risk Management – We use a risk-based approach to assess and monitor cybersecurity risks presented by our vendors, third-party service providers, and other third-party users that we partner with. • Security Awareness Education – We use current cybersecurity and information security threats to develop our education program. This training focuses on information security, privacy, cybersecurity best practices (e.g., social engineering, incident reporting, maintaining strong passwords), identity and access management, and physical security. All employees receive education and awareness training throughout the year. In addition, some of this education is extended to our customer base, with current cyber activity and hygiene highlighted.


text: To our knowledge, no cybersecurity incidents or threats have resulted in a reportable event, and have not materially impacted Nicolet's operations or financial condition. For additional discussion of cybersecurity risks, see Item 1A, "Risk Factors – Operational Risks."


text: Management informs the Audit Committee of material aspects of our cybersecurity program on a quarterly basis. This includes informing the committee on key strategic and operational goals, risk mitigation efforts, performance metrics, and descriptions and notification of emerging or existing risks as well as incidents impacting us.


text: Our Chief Information Security Officer ("CISO") is responsible for managing our information security team and implementing the Information Security Program. As discussed in further detail under "Risk Management and Strategy" above, the primary responsibilities of the information security team include IT governance, risk and compliance; identity and access management; security architecture and engineering; security operations; resiliency, safety and security; vendor risk management, and security awareness education. The team includes information security professionals with varying degrees of education and experience, and many team members are subject to professional education and certification requirements. In particular, our CISO has substantial relevant experience in the areas of physical security, information security, and cybersecurity risk management.


text: The management IT Steering Committee provides oversight and governance of the Information Security Program. This committee includes members of information security, compliance, audit, human resources, legal, operations, banking, and wealth. The committee generally meets monthly to review and provide oversight of our risk management strategy; audit reports related to our cyber and information security processes; third-party risk assessments; periodic testing of systems and infrastructure; status of employee and customer training; and updates on security incidents. More frequent meetings may occur in accordance with the incident response plan to facilitate timely assessment, monitoring, and reporting.


text: The Board is actively engaged in oversight of our cybersecurity practices, with the Audit & Compliance Committee having primary oversight responsibility. The Audit & Compliance Committee reviews and approves the information security program on an annual basis, as well as receives management updates about information security matters on at least a quarterly basis. Additionally, the full Board receives regular presentations by our CISO regarding pertinent cyber and information security topics. These updates cover external cybersecurity hot topics and notable events, current and emerging threats, cybersecurity program achievements and progress on key initiatives, key performance indicators, key risk indicators and notable internal events. In addition, the Audit Committee receives prompt reporting and updates on significant cybersecurity-related incidents.


text: Our management Info Sec Steering Committee has established an Information Security Program, which includes appropriate security risk assessments, security monitoring, incident response, policies, operating standards, compliance, and employee training. The underlying controls of this security program are based on the guidelines and frameworks provided by the Office of the Comptroller of the Currency (the "OCC"), the Federal Financial Institutions Examination Council (the "FFIEC"), and the National Institute of Standards and Technology ("NIST"), as well as industry best practices and standards. The Information Security Program focuses on the following key areas: • IT Governance, Risk & Compliance – As discussed in further detail under the "Governance" section below, we have established programs, policies, and procedures for security oversight, including risk assessments for business processes and applications. These cyber and information security programs, policies and procedures are reviewed annually by a third-party. • Identity & Access Management – We have established controls to mitigate risks related to unauthorized access, identity theft, and data breaches. Process and technology controls include identity, authentication, authorization, account management, and access, along with monitoring and logging for tracking events. • Security Architecture & Engineering – Our security is tailored around industry best practices and guidance. This establishes the foundation for secure resilient systems that can withstand and mitigate cyber risks effectively. • Security Operations – We use various tools to assess, monitor, and analyze the vulnerability of our operating systems, and have established an incident response plan for addressing identified threats and incidents. • Resiliency, Safety & Security – We have established policies and procedures to withstand and recover from disruption, protect our people and environment, as well as protect our systems and information from threats and unauthorized access. • Vendor Risk Management – We use a risk-based approach to assess and monitor cybersecurity risks presented by our vendors, third-party service providers, and other third-party users that we partner with. • Security Awareness Education – We use current cybersecurity and information security threats to develop our education program. This training focuses on information security, privacy, cybersecurity best practices (e.g., social engineering, incident reporting, maintaining strong passwords), identity and access management, and physical security. All employees receive education and awareness training throughout the year. In addition, some of this education is extended to our customer base, with current cyber activity and hygiene highlighted.


text: Our Chief Information Security Officer ("CISO") is responsible for managing our information security team and implementing the Information Security Program, in conjunction with our CIO and Director of IT. As discussed in further detail under "Risk Management and Strategy" above, the primary responsibilities of the information security team include IT governance, risk and compliance; identity and access management; security architecture and engineering; security operations; resiliency, safety and security; vendor risk management, and security awareness education. The team includes information security professionals with varying degrees of education and experience, and many team members are subject to professional education and certification requirements. In particular, our information security team has substantial relevant experience in the areas of information security and cybersecurity risk management.


text: Senior IT leaders are responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: STURM RUGER & CO INC

ticker: RGR


text: The Board is actively engaged in oversight of our cybersecurity practices, with the Risk and Audit Committees having primary oversight responsibility. The Risk Committee reviews and approves the information security program on an annual basis, as well as receives management updates about information security matters on at least a quarterly basis. In addition, the Audit Committee receives prompt reporting and updates on IT audits and material cybersecurity-related incidents. The full Board receives regular presentations regarding pertinent cyber and information security topics. These updates cover external cybersecurity hot topics and notable events, current and emerging threats, cybersecurity program achievements and progress on key initiatives, key performance indicators, key risk indicators, and notable internal events.


text: Wynn Resorts' information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees' and guests' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: The Chief Information Security Officer ("CISO") works closely with the Chief Information Officer and the Chief Privacy Counsel to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and ensure that the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as possible in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Wynn Resorts has established a separate committee comprised of the General Counsel, the Chief Financial Officer, the Chief Privacy Counsel, and the CISO. The Materiality Committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.


text: The Board of Directors oversees risks relating to cybersecurity. The CISO presents to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. The CISO has overseen the Company's information security program for the last 15 years. He holds a Bachelor of Arts degree in Business Administration, and has over 30 years' total experience in the information technology and security field, including various leadership roles before joining Wynn Resorts. In addition, he holds several industry technical certifications in information security, network engineering, systems engineering, database management, application development, and security intrusions.


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see "System failure, information leakage and the cost of maintaining sufficient cybersecurity could adversely affect our business" in Item 1A — "Risk Factors."


text: Wynn Resorts' information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees' and guests' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government and is integrated into our overall enterprise risk management system.


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and Company management and reports to the Company's Board of Directors and/or certain Board committees. As noted above, the Risk Oversight Committee regularly receives reports on cybersecurity matters from senior IT leadership.


text: The Chief Information Security Officer ("CISO") works closely with the Chief Information Officer and the Chief Privacy Counsel to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and evaluate whether the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as practicable in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Wynn Resorts has established a separate committee comprised of the General Counsel, the Chief Financial Officer, the Chief Privacy Counsel, and the CISO. The Materiality Committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see "System failure, information leakage and the cost of maintaining sufficient cybersecurity could adversely affect our business " in Item 1A — "Risk Factors."


text: has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Risk Oversight Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.


text: has an Information Security Program ("Program") to protect personal and proprietary information in compliance with applicable federal and state requirements. The Program is designed to: Ensure the security and confidentiality of employee and customer personal information and Company proprietary information;


text: Protect against anticipated threats or hazards to the security or integrity of such information; and Protect against unauthorized access to, use of, or transfer of such information in a manner that could harm or inconvenience the Company, employees or customers.


text: information about these risks, see the risk factor titled "The Company relies on its information and communications systems in its operations. Security breaches and other disruptions could adversely affect its business and results of operations" under Item 1A.


text: The Company's Board of Directors has assigned oversight of cybersecurity risk management to the Risk Oversight Committee. The Risk Oversight Committee regularly receives reports from management, including senior information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, the Company's full Board of Directors receives reports addressing cybersecurity as part of the Company's overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Cybersecurity Program The Company's cybersecurity program is an integral element of the Company's overarching strategic plan. The robustness of the cybersecurity initiatives directly impact the realization of the Company's mission, vision, and goals. Aligned with the National Institute of Standards and Technology Cyber Security Framework, the Company employs a comprehensive "defense-in-depth" strategy, deploying multiple security measures to safeguard its operational environment and data integrity systems.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: The Company continually evaluates and refines its cybersecurity program in response to key factors such as evolving threat landscapes, program maturation, gap analysis, and guidance from external security consultants. The Company's cybersecurity program relies on three key pillars: People, Process and Technology (PPT) to deliver a robust cybersecurity program. The cybersecurity program includes various aspects of PPT, including, but not limited to: Technology: Encryption, threat management, backups, monitoring, investigative support utilizing artificial intelligence embedded tools; Identity and Access Control Management Tools: Multi-factor authentication, monitoring and alerting of privilege account access; Cybersecurity Processes: Vulnerability scanning, penetration testing, and periodic assessments conducted by external security consultants;


text: Incident Response Training: Regularly assessed incident response preparedness through various incident response and disaster recovery exercises; and Cyber Risk Awareness and Training: Frequent simulation exercises to heighten awareness of cybersecurity threats and educate our user community on preventative measures and reporting protocols. All employees participate in required periodic training with respect to cybersecurity risk and risk mitigation.


text: Our Chief Technology Officer (CTO), with over 25 years of experience in various disciplines of information technology, oversees the cybersecurity program. Reporting to the Chief Executive Officer, the CTO provides regular briefs to the Board of Directors (the Board) and executive management, informing them about prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as ongoing risks and threats.


text: In our industry, the continuous functioning of information systems is of the utmost importance. Leveraging information technology systems, we collect, process and safeguard sensitive data and utilize automated tools to operate our plants.


text: Identified as a critical risk factor, cybersecurity threats encompass potential hazards such as malicious code, employee misconduct, advanced persistent threats, fraud, and phishing attacks.


text: These risks have the potential to lead to information technology system failures, threat to water supply, or compromise of sensitive information.


text: Our cybersecurity program aims to protect the uninterrupted availability of critical information technology resources. Regular assessments, conducted both internally and by third parties, evaluate our program against industry standards, including the National Institute of Standards and Technology Cybersecurity Standard and the Risk Management Framework.


text: Although we have not experienced cybersecurity breaches or incidents that have significantly impacted our financial condition, results of operations, or business strategy, the effectiveness of our measures to prevent, detect, mitigate, or recover is based on currently known threats and recovery methods. There is no guarantee that cybersecurity breaches or incidents will not impact our business operations, strategy, financial condition, or operations.


text: The ever-evolving landscape of cybersecurity threats introduces ongoing challenges. The Company recognizes the increasing frequency and sophistication of these threats. Despite implementing measures to secure operational and technology systems and fostering a culture of continuous improvement, the dynamic nature of cyber-attacks and vulnerabilities implies that these defenses may not be foolproof.


text: Cybersecurity Risk Management Program and Strategy Cybersecurity risk management strategy is an integral component of our operations and our overall risk management process. Recognizing the dynamic nature of cybersecurity threats, we have implemented a comprehensive risk management program that aims to identify, assess, and mitigate potential risks. Our strategy involves a proactive approach, incorporating preventative measures, continuous monitoring, and adaptive response mechanisms. We prioritize the safeguarding of our operational network environment, sensitive data, including confidential business information and personal details of our customers and employees. Regular assessments conducted both internally and by third parties ensure our cybersecurity program aligns with industry standards. In addition to a dedicated cybersecurity team, we employ a defense-in-depth strategy, utilizing multiple security measures to protect our information technology system. Collaboration with third-party experts, industry peers and ongoing training initiatives ensures our cybersecurity strategy remains robust and responsive to evolving threats. We understand the importance of maintaining a vigilant and adaptive stance in the ever-evolving landscape of cybersecurity to safeguard our business operations, financial stability, and as a direct result, our overall success. A dedicated cybersecurity team; Collaboration with a third-party managed detection and response company for 24/7 monitoring and response; Cybersecurity insurance to cover a portion of losses and damages resulting from cyber-attacks or security breaches; An incident response team that is comprised of various departments required for an effective response; Conducting periodic drills and exercises, including industry collaborations and participation from the executive team; Continuous information security awareness training and phishing simulation exercises; Regular security assessments to address evolving risks and threats;


text: Deployment of automation solutions to strengthen detection and response capabilities; and Utilizing services offered by the United States Department of Homeland Security to assist with resiliency planning.


text: Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations. In connection with these relationships, we perform due diligence, cyber risk scoring, cybersecurity related contractual obligations, and periodic reviews of third-party control environments to ensure alignment with the Company's risk exposure, business requirements, and risk tolerances.


text: We extend our cybersecurity focus to third-party service providers by evaluating and monitoring their cybersecurity risks. High-risk vendors undergo continuous monitoring, and we maintain contractual agreements that mandate our third-party providers' commitment to managing cybersecurity risks, providing incident notifications, and being subject to cybersecurity audits.


text: Cybersecurity Governance The Corporate Governance and Nominating Committee of the Board is tasked with overseeing cybersecurity risk. Management, including the CTO, provides regular reports to the Board covering aspects such as risks, threats, the evolving threat landscape, enhancements to the cybersecurity program, and the preparedness of internal responses.


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as the personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.

companyName: ENB Financial Corp

ticker: ENBP


text: The Corporation has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; a business continuity program (BCP) to ensure continuity of operations; and an incident response program documenting cybersecurity incident response and notification procedures. The Corporation's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees. The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors.


text: The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response, and holds multiple relevant professional certifications. The ISO provides periodic updates to the Board of Directors, including a comprehensive annual report. The Information Security, Vendor Management, BCP, and Incident Response Programs are approved by the Board annually.


text: The ISO maintains risk assessments for critical IT systems, vendors, and processes. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are used annually to assess these risks. Third parties are assessed to address their risks according to service type, compliance risk, financial risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on that assessment.


text: The ISO conducts training on cybersecurity risks for all new employees, and at least annually for existing employees and the Board of Directors. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks and to provide supplemental training as needed. The Corporation uses data loss prevention and web filtering software to ensure malicious data does not enter the Corporation's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. We employ an in-depth, layered, defensive strategy with respect to our products, services, and technology. We leverage people, processes, and technology to manage and maintain cybersecurity controls. We employ various preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.


text: Access to data on the Corporation's networks is granted only if needed for job functions. The Information Security Department approves all changes to access and critical systems are subject to annual review.


text: An Incident Response Team that includes representatives from key areas of the Corporation meets in the event of cybersecurity incidents. This Team receives special training, including an annual tabletop exercise. The Team ensures the proper notifications are made to comply with all relevant laws, rules, regulations, and policies.


text: During the year ended December 31, 2023, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Corporation.


text: Protect against anticipated threats or hazards to the security or integrity of such information; and Protect against unauthorized access to, use of, or transfer of such information in a manner that could harm or inconvenience the Company, employees or customers.


text: The Company has established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of its information technology systems, data, and operational continuity. The Company conducts risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of the Company's existing controls. Upon identification and assessment of risks, the Company develops and implements what management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. The Company maintains change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly test its systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into the Company's overall enterprise risk assessment process.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: information security team, which is led by the Company's Director of Information Technology and also includes the Company's Chief Financial Officer and other members of the Company's internal audit and finance departments, is responsible for assessing and managing the Company's cybersecurity risks and data protection practices. The Company's Director of Information Technology has over 10 years of experience in managing cybersecurity risks and advising on cybersecurity matters.