text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing monitoring.


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.

companyName: Kiromic Biopharma, Inc.

secItem: Item 1C


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: We maintain a team of internal and external information technology specialists who are responsible for the design, implementation, and operation of our information technology ecosystem and cybersecurity governance processes. We engage with certain external parties, including consultants, computer security firms and risk management advisors, peer companies, and industry groups in an effort to enhance our cybersecurity oversight and risk management strategy. We also use security technologies, including third-party solutions and monitoring tools that are designed to identify and mitigate cybersecurity risks. Further, we regularly engage third parties to conduct penetration testing, security assessments and tabletop exercises. We also engage a virtual chief information security officer ("vCISO") to support and advise on our cybersecurity program. We have a process to consider the internal risk oversight programs of critical third-party service providers before engagement, including through security questionnaires and contractual requirements, as appropriate. In addition, in an effort to deter and detect cyber threats, we have implemented an annual training program to provide employees with data protection, cybersecurity and incident response and prevention training.

companyName: Scholar Rock Holding Corp

ticker: SRRK

stage1Category: Risk Management Process

stage1Method: unanimous


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors."

stage1Category: Strategy Integration


text: Governance Related to Cybersecurity Risks The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management, including from our Vice President, Information Technology, or the VP of IT, regarding cybersecurity matters, such as relevant cybersecurity risk assessments, as applicable. We have established a process for the Audit Committee to be notified in the event of significant cybersecurity threats or incidents.

stage1Category: Board Governance


text: The VP of IT leads the operational oversight of company-wide cybersecurity strategy, policies, processes, and support staff. Additionally, the VP of IT works across all relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The VP of IT reports and provides regular updates to the Chief Operations Officer and Chief Financial Officer on the cybersecurity program as well as periodic updates to executive management, as needed. Our VP of IT has worked in the information technology field for over 19 years at biotechnology companies including publicly-traded organizations.

stage1Category: Management Role


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Corvus Pharmaceuticals, Inc.

ticker: CRVS


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee has received reports from management on our cybersecurity risks and will receive such reports on a periodic basis going forward. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities which include those related to cybersecurity.


text: Orient. Identify Information Systems and assets, regulatory requirements, and overall risk approach, identify threats to, and vulnerabilities of, those systems and assets. Risk assessment. Identify the likelihood of a cybersecurity event and the impact on the organization. Consider emerging risks. Target Profile. Create a Target Profile focusing on categories, subcategories, and desired cybersecurity outcomes.

companyName: ATEL 14, LLC


text: As part of our management team, Leiv Lea, our Chief Financial Officer, who has over fifteen years of experience overseeing information technology systems for public companies, is responsible for assessing and managing our material risks from cybersecurity threats. Mr. Lea has primary responsibility for our overall cybersecurity risk management program and supervises our retained external information technology and cybersecurity consultants. Mr. Lea supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from security personnel and alerts and reports produced by security tools deployed in the Company's information technology environment.

stage1Method: majority


text: Cybersecurity risk is a significant operational risk facing our business. Cybersecurity risks result from intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our clients' or third parties' operations, systems or data. Cybersecurity risk management is an integral element of the Company's overall risk management strategy.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Chief Technology and Information Security Officer ensures the coordinated and consistent implementation of risk management initiatives and strategies on a frequent basis with our Chief Operating Officer and Chief Financial Officer. Results of the information and cybersecurity efforts and recommendations are reported by the Chief Technology and Information Security Officer to the IT Steering Committee, Risk Management Committee and Board of Directors no less than quarterly. The Audit Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. Our management is directly involved in assessing and managing cybersecurity risks.


text: The Company uses the National Institute of Standards and Technology Cybersecurity framework ("NIST CF") for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We utilize Payment Card Industry Data Security Standards, and other applicable standards, laws, and regulations. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, and security event monitoring and security awareness. Certain processes involve the use of third parties.


text: Risk Assessment Process. On an annual basis, a risk assessment and maturity analysis is performed for the Company based on the NIST CSF Framework. The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events. The risk assessment considers the inherent risk and controls implemented at the Company and measures the residual risk to ensure it is within the Company's risk tolerance.


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the Company's information systems environment. Identified vulnerabilities are classified and scored based on severity, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.


text: Threat Management Process. In addition to the regular and routine vulnerability scanning, the Company relies on various threat intelligence feeds for the identification and awareness of potential threats that could impact the Company's environment. Using third party vendors to assist, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the Company environment. We continually enhance the cybersecurity capabilities based on evolving threats. We have adopted an incident response plan that applies in the event of a cybersecurity threat or incident.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests look at our customer facing applications, how we respond to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail utilizing best practices and the involvement of third party experts, as well as internal Information Security personnel and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.


text: Access Management. Utilizing a least privilege, need-to-know access methodology, access is controlled through a centralized user access management function responsible for the provisioning, transfer and de-provisioning of users' access. Access management also performs routine reviews of application and systems access to ensure access remains appropriate. For third-party hosted environments, access management works with security architecture to ensure single sign-on controls are employed or additional factors are utilized to prevent unauthorized access to these environments.


text: Network Security Management. The security of the Company's network infrastructure is maintained via the use of some network segmentation to isolate access to certain applications and systems, email filtering to identify spam, malware, and phishing messages in received email messages, data loss prevention controls to prevent the theft, or mass exfiltration of data, Virtual Private Networks to control remote access to our network, network access controls are in place to prevent unauthorized assets from connecting to the network, and web filtering.


text: Security Event Monitoring. The Chief Technology and Information Security Officer and Information Security personnel work together as centralized security monitoring team and are responsible for the response to alerts generated from a consolidated log collection system. Log collection occurs from various assets and hosted environments. The 24 x 7 monitoring is third-party provided security information and event management tool, and enables threat identification, detects suspicious activity in the environment using a nationally recognized, third-party framework, performs user behavior analytics, and endpoint detection and response. Alerts are investigated to ascertain whether a cyber-incident is occurring or not.


text: Security Awareness. Quarterly training is conducted for continuing education for all employees and monthly phishing tests are administered. We also email and post articles on our intranet of common attack schemes for our employees awareness. An annual cyber report is presented to the Board of Directors with monthly cyber reports.


text: Our Vendor Management Policy contains policies and procedures to follow when utilizing external third-parties and due diligence is performed over new vendors prior to engaging in services. Vendor Management ensures key risk components are mitigated based on acceptable Company standards. Any third parties used in any cybersecurity processes are vetted through our vendor management process.

stage1Category: Third-Party Risk


text: Risks from Cybersecurity threats or previous incidents have not materially affected business strategy, results of operations, or financial condition. A vendor management report is presented to the Board of Directors on an annual basis by the Chief Technology and Information Security Officer.


text: Risk Management and Strategy The Company considers cybersecurity risks as part of our overall risk management process. The management team works closely with our IT consultants and IT auditors to ensure potential risks are mitigated within our systems.

companyName: Epsilon Energy Ltd.

ticker: EPSN


text: The Company engages a third-party IT consulting firm and conducts an annual IT audit to test our risk management processes.


text: The Company, together with our IT consultants and auditors, has processes that thoroughly vet third-party service providers, continuously monitoring to ensure compliance with our cybersecurity standards. The Company has not encountered cybersecurity threats that have materially impacted our business or operations.


text: The Company's Board of Directors is aware of the impact of potential cybersecurity threats and stays in close contact with management in case a threat is identified.


text: The Audit Committee of the Board of Directors is the primary governing body that is tasked with the evaluation and confirmation of the Company's cybersecurity threat mitigation processes. More specifically, they review the Company's annual IT audits and discuss any potential threats in quarterly meetings.


text: The Chief Financial Officer, Chief Operating Officer, Controller, and Director – Finance are all involved in communications with our IT consultants and auditors. The Chief Financial Officer notifies the Audit Committee and Chief Executive Officer of any cybersecurity threats.


text: The Company's information security program is designed with the goal of maintaining the safety and security of its systems and data. The risk management program is designed to identify, assess, and mitigate risks across various aspects of the company, including financial, operational, regulatory, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. With the departure of the Company's Chief Information Officer during the first half of 2023, the Company has engaged a third-party cybersecurity expert to assess the security of the Company's systems and networks. In addition, the Company engaged a third-party vendor, along with an in-house system administrator, together the "IT Management", to service the Company's information systems.


text: The objective in managing cybersecurity risk is to avoid or minimize the impact of efforts to penetrate, disrupt or misuse Company systems or information. Cybersecurity helps to maintain an environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, and privacy. IT Management is charged with cybersecurity and uses a layered approach to protect systems with ESET and Cylance.


text: In addition, the Company has established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists.


text: The Company also leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program. The Chief Operating Officer manages the Company's IT and cybersecurity environment, which is reviewed at least semi-annually.


companyName: ATEL 15, LLC


text: IT Management uses a risk-based framework core consisting of cybersecurity activities, outcomes, and references that provide guidance for developing individual organizational profiles. IT Management is tasked with and shall:


text: Prioritize and scope. Identify organization objectives and priorities and determine the scope of systems and assets that support the selected business line or process.


text: Orient. Identify Information Systems and assets, regulatory requirements, and overall risk approach, identify threats to, and vulnerabilities of, those systems and assets. Risk assessment. Identify the likelihood of a cybersecurity event and the impact on the organization. Consider emerging risks. Target Profile. Create a Target Profile focusing on categories, subcategories, and desired cybersecurity outcomes.


text: Determine, Analyze, and Prioritize Gaps. Compare the Current Profile and the Target Profile to determine gaps and create a prioritized action plan to address those gaps. Implement Action Plan. Determine actions to take and monitor against the Target Profile.


text: Individual consent to the use of personal information Collecting the minimum amount of personal information Controls over the use and disclosure of personal information Use and retention of personal information related to a cybersecurity incident Transparency for certain cybersecurity activities


text: Accountability and auditing IT Management ensures that the Company's risks are properly monitored, managed and mitigated to the extent possible; and oversees the implementation and maintenance of formal strategies that govern information resources.


companyName: ATEL 16, LLC


companyName: ATEL 17, LLC


text: We do not store any customer data input during the reservation process. The customer reservation systems are specified, implemented, and managed by the global hotel brands.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Our Vice President of Information Technology ("VP of IT") with assistance from our third-party managed services team, legal, quality, finance and human resources, identifies, assesses and manages the Company's cybersecurity threats and risks. The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual and automated tools, analyzing reports of threat actors, conducting scans of the threat environment, evaluating threats reported to us and coordinating with law enforcement concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; disaster recovery and business continuity plans; implementation of security standards; network security controls; access controls; system monitoring; and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified by the Company's senior management team. Also, IT consultants work with management to follow the National Institute of Standards and Technology framework for cybersecurity to mitigate cybersecurity threats that are more likely to lead to a material impact on our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms including outside legal counsel, cybersecurity consultants, threat intelligence service providers, managed cybersecurity service providers and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, reviews of vendor's written security program and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a significant disruption of our product development programs and can lead to adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; reputational harm; loss of revenue or profits; loss of customers or sales; disruption of our business operations."

stage1Category: None/Other


text: Our board of directors and audit committee addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Financial Officer and our VP of IT who has over 40 years of experience in information technology and cybersecurity and manages the Company's information technology infrastructure.


text: The VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The VP of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The VP of IT works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: In the ordinary course of our business, we collect, maintain and transmit large amounts of confidential information in digital form, including intellectual property, proprietary business information, financial information, personal information, protected health information and data to comply with cGMP and data integrity requirements. It is critical that we do so in a secure manner to maintain data security and data integrity of such information. We have established physical, electronic and organizational measures to safeguard and secure our systems to prevent a data compromise. We have also outsourced elements of our information technology infrastructure and data security processes to a number of expert qualified third-party vendors to help us stay current with data and electronic information security best practices.

companyName: NextCure, Inc.

ticker: NXTC


text: We have implemented processes designed to identify, review and manage risks from potential data breaches, unauthorized occurrences, and other information security losses on or through our information technology systems that could result in adverse effects on the confidentiality, integrity, and availability of our systems and electronic information. These processes are managed and monitored by our information technology (IT) team as managed by our Chief Operating Officer, or "COO". Our COO has experience in overseeing our cybersecurity and information technology programs. We rely heavily on information technology consultants for advice and expertise on monitoring evolving industry standards and to monitor our compliance with applicable policies. Our processes include mechanisms, controls, technologies, and systems designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. With the assistance of our third-party vendors, we conduct regular penetration and vulnerability testing, security audits, and ongoing risk assessments. Our internal information technology team conducts due diligence on key technology vendors, contractors and suppliers. We also conduct periodic employee training on cyber and information security, among other topics, and conduct internal false flag and/or phishing campaigns to identify any employees that might need additional training.


text: Our COO, together with our internal IT team, are responsible for assessing and managing cybersecurity risks. They review at least quarterly with our expert advisors our cybersecurity measures and procedures in view of the Company's cybersecurity risks to anticipate future threats and trends, and determine whether and how to adjust our strategies and processes accordingly. During the year ended December 31, 2023, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We depend on data and our information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."


text: The Board of Directors, with the assistance of the Audit Committee, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our COO. The Board also receives updates from the Audit Committee on cybersecurity risks on at least an annual basis.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include operational risks, intellectual property or trade secret theft, improper disclosure of confidential information, fraud, extortion, harm to employees or customers, and violation of data privacy or security laws.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal information technology ("IT")


text: audits, and IT security reviews. To defend, detect, and respond to cybersecurity incidents, we perform cybersecurity reviews of systems and applications; audits of applicable data policies; vulnerability assessments and penetration testing using external third-party tools to test security control; security incident and event management; continuous monitoring, and threat intelligence gathering; conduct employee training; and implement appropriate changes.


text: We leverage third-party expertise to audit and test our cybersecurity program and perform employee awareness training. These include periodic reviews of cybersecurity threats and related controls, including review of periodic penetration testing conducted by independent third parties.


text: We maintain a cyber liability insurance plan underwritten by multiple insurance companies, which provides protection against certain potential losses arising from cybersecurity incidents.


text: Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Our Board of Directors delegated oversight of Cybersecurity to the Audit Committee. Our board members receive reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as service providers and suppliers, and the current threat environment. These updates are presented by IT third-party experts, finance, and legal departments. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and updates to our cybersecurity risk management and strategy programs. Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; Reviewing our risks and cybersecurity programs and policies; Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs;


text: Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy.


text: Our management engages with third-party experts who have significant IT expertise and broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats, business continuity and disaster recovery, and regulatory compliance. Such individuals have significant prior work experience in various roles involving IT security, auditing, compliance, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents and design.


text: We recognize the critical importance of maintaining the trust and confidence of business partners, employees and patients, toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the UK governments' National Cyber Security Centre and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the UK governments' National Cyber Security Centre. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: leverage the National Cyber Security Centre incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our response to an incident involves the coordination of activities to detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including having a third-party independent qualified and accredited advisor review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we would require those third parties, although there are currently none, that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor heading " Security incidents, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability " which disclosures are incorporated by reference herein. We have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes. In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experience any cyber security incident.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer. Our Chief Financial Officer has been responsible for our IT functions for 20 years, and has managed the IT function of companies generally for the last 35 years. Our IT manager has managed our IT functions for over 20 years. The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, periodically.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain various cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Our cybersecurity function, led by our Head of DevSecOps and supported by our Head of IT and third-party service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of our threat environment, evaluating our and our industry's cybersecurity risk profile, evaluating threats reported to us, completing internal and external cybersecurity audits, completing third-party cybersecurity threat assessments, conducting vulnerability assessments, leveraging external intelligence feeds, and completing third-party red/blue team exercises and tabletop incident response exercises.


text: Depending on the environment, we implement and maintain technical, physical, and organizational measures, processes, standards, practices, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures, processes, standards, practices, and policies address, for example: incident detection and response, risk assessments, security certifications, encryption, network security controls, data segregation, access controls, physical security, asset management (such as tracking and disposal), systems monitoring, employee cybersecurity awareness training, and systems monitoring. We also have cybersecurity insurance.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk assessment process. We have a cybersecurity-specific risk assessment process designed to assess identified material risks from cybersecurity threats. This process is designed to help us manage our material risks from cybersecurity threats and protect against, detect, and respond to cybersecurity incidents.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers and cybersecurity consultants that provide threat intelligence, managed cybersecurity, forensic, and penetration testing services.


text: Further, we use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, data hosting companies, contract research organizations, and contract manufacturing organizations. We have certain vendor management processes designed help to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, security questionnaires and the imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the cybersecurity risks and related impacts that may materially affect the Company and how they may do so, see our risk factors in Part I, Item 1A of this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in adverse consequences that materially affect our business, including without limitation regulatory investigations or actions, a material disruption of the development programs of our product candidates, damage to our reputation and/or subject us to costs, loss of customers or sales, fines and penalties or lawsuits."


text: Cybersecurity Governance Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and data breaches. On a quarterly basis, the Audit Committee receives an overview from our Head of IT regarding our cybersecurity threat risk management and strategy processes, which may include, for example, covering topics such as data security posture, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Chair of the Audit Committee periodically updates our Board of Directors on its oversight of cybersecurity and data breach risk management and strategies.


text: Our executive management team, with regulatory and governance oversight from our Audit Committee, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Digital and IT Steering Committee is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity function, led by our Head of DevSecOps and supported by our Head of IT and third-party service providers, is responsible for our cybersecurity risk management and strategy processes. Our Head of IT, who is a Certified Information Security Manager (CISM ISACA) and a Certified Information Systems Auditor (CISA ISACA), and our Head of DevSecOps, collectively have significant prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: Our cybersecurity incident response plan provides for escalation of certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, COO, and CEO. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our incident response team also reports material cybersecurity incidents to the Chair of the Audit Committee.


text: Glen Burnie Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Senior Vice President, Director of Information Technology. In addition, the Internal Auditor and Compliance Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: The Senior Vice President of Information Technology supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Director of Information Technology, in coordination with compliance and human resources, conducts at least annual and ongoing company-wide information security awareness training. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during vendor onboarding, the inclusion of protective provisions in vendor agreements, and risk-based monitoring of vendors on an ongoing basis.


text: The Board of Directors receives regular reports from the Senior Vice President, Director of Information Technology and the Information Security Officer on Glen Burnie Bancorp's cyber risks and threats, the status of projects to strengthen Glen Burnie Bancorp's information security systems, assessments of Glen Burnie Bancorp's security program, and the emerging threat landscape. Additionally, the Information Technology Committee drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. Glen Burnie Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Information Technology Committees of the Board. The Company also engages with key vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Information Technology Committee and Board of Directors.


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: Cyber Risk Management and Strategy Under the oversight of our board of directors and the Audit Committee of the board, we have adopted cybersecurity risk management processes that take a risk based approach to assessing, identifying, and managing risks from cybersecurity threats. Management of cybersecurity risks is part of our overall risk management strategy.

companyName: TELA Bio, Inc.

ticker: TELA


text: We engage third-party service providers to assist us with our cybersecurity risk management, including for network monitoring, antivirus protection, and managing IT environments. We have also engaged third party advisors and consultants to conduct periodic testing of our processes and systems. Before contracting with certain third parties, such as those that have access to our IT networks, we have a process to conduct diligence on those third parties, which includes a security assessment. We have also implemented a process for employees to undergo cybersecurity training during onboarding, and thereafter, on an annual basis as part of our larger compliance training program.


text: We have established monitoring procedures in our effort to mitigate risks related to cybersecurity incidents. As part of our cybersecurity risk management, we have adopted a business continuity and incident response plan, which is designed to establish our processes for identifying and responding to significant events that may lead to a business disruption or crisis, including those arising from or related to cybersecurity threats.


text: Our board of directors holds oversight responsibility over our strategy and risk management, including risks related to cybersecurity. The board's oversight of cybersecurity risk management is supported by the Audit Committee, which has responsibility for discussing with management significant cybersecurity risks and the measures we have implemented to monitor and control such cyber risk exposures. The Audit Committee receives quarterly updates from our Vice President, Information Technology & Compliance ("IT Officer") relating to IT and cybersecurity matters, including cybersecurity risks and threats. The Audit Committee provides periodic updates to our board of directors on cybersecurity matters discussed at such meetings. Our IT Officer also provides these and similar reports to the full board of directors on a biannual basis.


text: Our IT Officer oversees the day-to-day management of the Company's cybersecurity risk management program. Our IT Officer has over 15 years of experience in IT leadership, and has managed IT for our company for approximately 10 years. Our IT Officer reports to our Chief Operating Officer and Chief Financial Officer and is a member of our Compliance Committee. Our IT Officer coordinates with our legal department and relevant third parties, such as consultants and external legal advisors, to assess and manage material risks from cybersecurity threats. Our IT Officer is also supported by a cross-functional incident response team, which is empowered to review, assess, report, monitor and take action to mitigate or remedy any cybersecurity incidents pursuant to our business continuity and incident response plan. Our IT department further supports and has dedicated resources to assist our IT Officer in monitoring, preventing, detecting, mitigating, and remediating any cybersecurity incidents pursuant to our policies and procedures.


text: We have also established a Disclosure Committee, which regularly reviews relevant information related to potential public disclosure of critical business risks and material events.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Form 10-K.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BioXcel Therapeutics, Inc.

ticker: BTAI


text: We designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we used the National Institute of Standards and Technology Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a management team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Business interruptions could adversely affect future operations, revenues, and financial conditions, and may increase our costs and expenses."


text: Each hotel or operating asset within our portfolio is a standalone network. Therefore, if a security breach were to occur at one location, it is fully isolated from other properties or networks.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the internal Security Incident Management Team or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Security Incident Management Team, which includes our Chief Financial Officer, the Executive Director of Information Technology, Chief Legal Officer and the Quality Assurance Director, has approximately 30 combined years of risk management experience and is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Security Incident Management Team's experience includes prior work experience in cybersecurity; financial management and controls, data quality assurance and liability and risk management.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors (the "Board"), primarily through its audit committee of the Board (the "Audit Committee"). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report on Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors, "We are reliant on information technology systems and may be subject to damaging cyber-attacks or security breaches" and "We are subject to data privacy laws, rules and regulations and any non-compliance with such laws, rules and regulations, could adversely affect our business, financial condition and operating results" in this Annual Report on Form 10-K.


text: Board of Directors The Audit Committee oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Company's Senior Vice President Head of Information Technology ("SVP IT") provides reports on cybersecurity matters, including material risks and threats, annually or more frequently as appropriate to the Board, including to the Audit Committee.


text: Under the oversight of the Audit Committee, and as directed by the SVP IT, Company management is primarily responsible for the assessment and management of material cybersecurity risks.


text: The SVP IT brings over two decades of extensive experience in global technology organizations spanning various industries. With a background encompassing more than 20 years of expertise in information security, risk management, and compliance, the SVP IT has successfully led cyber security initiatives and ensured compliance with regulatory standards such as Payment Card Industry ("PCI") and Sarbanes-Oxley ("SOX"). The SVP IT is also supported by an Incident Response Team Security Officer ("IRT Security Officer") who provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents. The Company's IRT Security Officer has completed rigorous cybersecurity awareness and threat response training, equipped with the skills to develop effective incident response plans and swiftly mitigate emerging cyber threats. With expertise in threat detection, incident coordination, and remediation, the IRT Security Officer contributes to enhancing the Company's cybersecurity posture and readiness.


text: All dollar amounts expressed in thousands, except per share amounts The SVP IT oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. The SVP IT also coordinates with the Company's General Counsel and Interim Chief Financial Officer and Chief Accounting Officer (the "Interim CFO and CAO") to assess and manage material risks from cybersecurity threats. The SVP IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.


text: The Company's Disclosure Committee, with the assistance of its Cybersecurity Subcommittee, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Interim CFO and CAO, General Counsel, Vice President of Investor Relations and Communications, Corporate Controller, and Financial Reporting Manager. The Cybersecurity Subcommittee of the Company's Disclosure Committee is comprised of, among others, the Company's Interim CFO and CAO, SVP IT, General Counsel, Corporate Controller, and IRT Security Officer.


text: The SVP IT, or a delegate, informs the Cybersecurity Subcommittee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes. The Cybersecurity Subcommittee is also primarily responsible for advising the Disclosure Committee and the Company's CEO and Interim CFO and CAO regarding cybersecurity disclosures in public filings. The SVP IT, with the General Counsel in attendance, also notifies the Audit Committee chair of any material cybersecurity incidents.


text: Risk Management and Strategy Our cybersecurity risk management program, a critical component of our overall enterprise risk management program, is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, Center for Internet Security Controls, regulatory guidance, and other industry standards. These frameworks provide a risk-based model for organizations to identify and manage cyber risks inherent to their business model.

companyName: SIERRA BANCORP

ticker: BSRR


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Using people, processes, and technology, we employ a variety of preventative and detective tools designed to monitor, alert, contain, and/or block suspicious activity. We design and implement controls designed to mitigate cyber risk, including ongoing education and training for employees and customers, preparedness simulations and tabletop exercises, and recovery and resilience tests. We actively monitor email for malicious phishing email campaigns and monitor remote connections. Additionally, we maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers.


text: Our Incident Response Plan, coordinated through the Senior Information Security Officer, provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation. The Incident Response Plan includes key members of executive and senior leadership, facilitates coordination across multiple parts of our organization, and is evaluated regularly.


text: We perform regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists, and engage independent auditors to periodically review our cybersecurity program, including our process, systems, and control effectiveness, and provide recommendations to continuously strengthen our program. Additionally, management conducts both bottom-up and top-down enterprise risk assessments, which include cyber security risk, and continuously monitors industry and government threat intelligence to identify emerging risks and ensure continued program effectiveness. For additional discussion, on cybersecurity risk, see Item 1A. Risk Factors, section 1.08 "Unauthorized disclosure of sensitive or confidential information, whether through a cyber-attack, or breach of our computer systems or any other means, severely harm our business."


text: The Senior Information Security Officer, Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program. The Director of IT and Director of Information Services report to the Chief Administrative Officer and are responsible for designing and maintaining the company's network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence. The Senior Information Security Officer (ISO) reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities. The ISO is responsible for the development and management of our information security program, which includes cybersecurity risk assessments, incident response, third-party risk management, and testing of first line activities.


text: We deploy stringent email filtering that prohibits incoming messages from insecure email systems (i.e., gmail, yahoo, aol, etc.) that are known to carry viruses, spyware, crypto ransom, etc. We perform regular internal and external penetration tests.


text: Our Board of Directors and Executive Officer Committee have delegated oversight authority to a management-level IT/Operations Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise. The IT/Operations Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience. The ISO and Director of IT present Information Security and Information Technology reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats. This information is subsequently reported up to the Board Risk Committee.


text: The Board Risk Committee is responsible for oversight of the Company's enterprise risk management program, which encompasses information technology, information security and cybersecurity. This includes management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Board Risk Committee also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs. Annual independent assessments of the Company's cybersecurity program which are completed by external parties with the required expertise are also presented to the Board Risk Committee. The Chief Administrative Officer and Chief Risk Officer report to the Board and/or Board Risk Committee on cybersecurity risks and other matters reviewed by the IT/Operations Committee. Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Administrative Officer and/or the Chief Risk Officer, who will share these with the Company's Executive Officers and Board members, as appropriate.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: We have leveraged the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Senior Director of Information Technology (IT) is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Director of IT has nearly 15 years of experience as an information technology professional.


text: Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.


text: The Company deploys advanced cybersecurity technologies and best practices to deliver a highly secure technology platform for its internal operations and hotels throughout its national portfolio. Our program is built around best practice guidance taken in part from both NIST and PCI DSS framework.


text: Risk Management and Strategy We have engaged a third-party IT and cybersecurity firm to assist us in protecting us from cybersecurity threats. Our IT partner has been in business for over 33 years and has a national footprint of 175 offices nationwide. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers.


text: TPG's Corporate IT footprint and systems are not used to process guest transactions. Corporate systems do not have connectivity to any hotels.


text: All IT assets and infrastructure are monitored 24/7/365 through a combination of automated detection software, SIEM software and a fully staffed 24/7 SOC. We have continuous monitoring for viruses, intrusions, and malicious activities.


text: We deploy a sophisticated blend of layered security that protects systems and data that exist or operate within partitioned/segregated networks.


text: Employee cybersecurity training and phishing email training are required for all employees and is performed monthly to continually enhance awareness and responsiveness.


text: We have in place a Cybersecurity Incident Response plan that dictates the process for responding to incidents and remediation of events. We have relationships with third-party business partners to assist with cybersecurity as well as assess their cybersecurity risks.


text: We utilize Self-Assessments using industry standards and benchmarks to identify cybersecurity incidents and threats that could potentially impact the company.


text: Our IT internal controls are audited by an external audit firm as part of our Sarbanes-Oxley Act compliance activities, and this process includes assessing the design and operating effectiveness of those controls.


text: We or our third-party manager currently maintain cybersecurity insurance policies that provide coverage for security incidents. Although the risks we face from cybersecurity threats are many and change daily, we have not experienced any cybersecurity incidents that have materially affected our operations, strategy, financial positions or operations. In addition, as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations and financial condition.


text: Despite the policies and procedures that have been implemented to ensure the integrity of our IT systems, we may not be effective in identifying and mitigating every risk in which we are exposed to, especially newly identified vulnerabilities. Furthermore, the hospitality environment requires that the hotels access information in third party environments that are managed, hosted, and provided by others. As such the company will have difficulties in anticipating and implementing preventive measures that mitigate the harm should a break occur.


text: Malicious actors, which can operate on a larger and more sophisticated scale, are using various tools and methodologies to gain access to systems. Such attacks are ransomware, denial of service attacks, phishing, social engineering, and other cyberattacks. A breach of these systems either managed by us or a third party may result in the loss of business data, personal information, disruption of business.


text: Our board of directors are responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On a quarterly basis, our board of directors and audit committee receive a report from management on our cybersecurity threat risk management processes and strategies. Outside of quarterly meetings, our board of directors and audit committee are notified following any cybersecurity incident and meet to address and identify the cybersecurity threat's severity levels. Our board of directors and audit committee also review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.


text: Risk Management and Strategy We have programs for assessing, identifying, and managing material risks from cybersecurity threats through the use of a suite of various security programs and tools including, but not limited to, Managed Security Service Provider and Extended Detection and Response monitoring and alerts, internal reporting mechanisms, monitoring tools, detection tools and continuous training. Our information security program undergoes regular evaluations, internal audits and various exercises, including tabletop, penetration, vulnerability testing and simulations. The findings from these activities, including identified security gaps, are integrated into our risk remediation process and subsequently updated across our suite of security tools and applications. Additionally, we conduct annual Payment Card Industry Data Security Standard compliance reviews and third-party penetration testing.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Our global cybersecurity team consists of multidisciplinary Information Technology ("IT") resources from key areas and locales led by our Global Director of Cybersecurity. They are primarily responsible for delivering comprehensive reporting to executive management and auditors, addressing a wide array of cybersecurity threats, assessments, findings and future direction and strategy.


text: Continuous endpoint monitoring is ensured through collaboration with a third-party cybersecurity firm. Rapid response protocols are in place for high or critical severity incidents, involving isolation, segmentation and forensic examination by our cybersecurity team. In addition, we have engaged a dedicated third-party threat hunter to assist in identifying Indicators of Compromise.


text: Our Global Director of Cybersecurity leads a quarterly cybersecurity governance meeting, comprising of all IT teams from our subsidiaries. This meeting serves as a platform to review and discuss ongoing and upcoming security projects, compliance, and regulations.


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention material, which educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: We conduct a comprehensive annual tabletop exercise facilitated by an external cybersecurity specialist. This exercise involves simulating various attack vectors, utilizing our incident response plans and procedures to respond effectively, prevent, block, and remediate potential threats. This exercise also includes preparing for other related potential impacts to the Company, such as business interruptions, business continuity plans, backup strategies, data protection policies and compliance, incident response, third-party forensic and legal assistance, as well as consideration of regulations such as GDPR, CCPA, PCI and other cybersecurity regulations. This tabletop exercise is attended by members from all subsidiaries, including IT management teams as well as finance, legal, insurance, and operations management teams. We believe our holistic approach ensures we are well-prepared and coordinated to handle a range of cybersecurity scenarios.


text: Our annual testing, which is conducted by an industry-leading third-party cybersecurity firm, encompasses external and internal penetration tests, Wi-Fi tests, social engineering and physical access testing for all subsidiaries. We also use a vulnerability management platform to provide comprehensive visibility and tracking of assets to aid us in systematically identifying, measuring and prioritizing cybersecurity and technology risks. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.


text: Our third-party information technology vendors are assessed by independent auditors for compliance with System and Organization Controls ("SOC") 1 and SOC 2. Access to our networks for third-party vendors is limited exclusively to the application related to the services for which they are engaged to provide. We routinely conduct external risk analyses by employing third-party rating tools to assess our vendors, quantifying and prioritizing identified risks based on the number and severity of vulnerabilities. Subsequently, we communicate these risks to our vendors proactively, seeking their collaboration in remediation efforts.


text: We annually purchase cybersecurity risk insurance policies that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Our board of directors maintains comprehensive oversight of company-wide risk assessment by conducting in-depth analysis of key risks related to information security, technology and cybersecurity threats. The audit committee of our board of directors oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee receives quarterly reports on cybersecurity matters, including material risks and threats, from our Chief Information Officer ("CIO") and our cybersecurity team. In the event of a cybersecurity incident, our Global Director of Cybersecurity or senior Information Technology management will notify our Disclosure Committee in accordance with the escalation criteria set forth by our incident response plan and related processes. Security incidents and events are classified based on severity (Critical, High, Medium), impact, and nature, as outlined in the Incident Response Plan. This classification system assists the cybersecurity team in prioritizing responses, allocating resources efficiently, and effectively managing risks.


text: Our Disclosure Committee is comprised of, among others, our Chief Financial Officer, Chief Growth and Operations Officer, CIO, Senior Vice President of Finance, Executive Vice President and Director of Strategic Planning, Senior Vice President of Investor Relations and Treasurer, Senior Vice President of Legal Counsel, Vice President of Legal Counsel, and the most senior members of the financial reporting, internal audit, financial planning and analysis, and tax functions.


text: Our CIO has over 28 years of experience leading our technology operations and a total of over 40 years of experience in information technology experience in the banking and fashion apparel industries. Our Global Director of Cybersecurity has over 20 years of experience in information technology, including a dedicated focus of more than 6 years in cybersecurity, risk management and compliance and he is a Certified Information Systems Security Professional ("CISSP") and a Certified Ethical Hacker ("CEH"). Additionally, our Global Director of Cybersecurity currently serves in the role of a governing body member for the New York Evanta CISO community.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see our "Risks Related to Cybersecurity, Data Privacy and Information Technology" contained in Item 1A - Risk Factors of this Annual Report on Form 10-K.


text: We depend on a variety of information systems and technologies to maintain and improve our competitive position and to manage the operations of our business, including supply chain, merchandising, point of sale, e-commerce, marketing, finance, accounting, and human resources. Our core business systems consist mostly of purchased software programs that integrate together with our internally developed software solutions across a company-wide network that connects all corporate users, stores, and our distribution center infrastructure.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: We manage data security and privacy at the highest levels. The Company's Board of Directors oversees an enterprise-wide approach to risk management (ERM), designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. Management is responsible for the Company's day-to-day risk management activities and processes, and our Board's role is to engage in informed oversight of, and provide guidance with respect to, such risk management activities and processes. The Company's cybersecurity policies, standards, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, proactive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Collaborative Approach. The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt identification and escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards. The Company's Security Operations Center, led by our Vice President IT Risk Management (Chief Information Security Officer), constantly and proactively monitors our network and application landscape for threats and anomalies. The Security Operations Center deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Plan. The Company has established and maintains a comprehensive incident response plan that addresses the Company's response to a cybersecurity incident.


text: Third-Party Risk Management. The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Training. All Ulta Beauty associates have a role as stewards of Company data, and we educate them on how to keep data safe. As part of the Company's annual security awareness training and regular training around phishing, we train associates on how to keep devices and data safe in public places; how to avoid security threats and phishing scams; how to maintain a secure workplace; and everyday practices that help maintain the security of corporate digital devices, data and systems.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. We assess ourselves against the National Institute of Standards and Technology Cybersecurity Framework, Payment Card Industry Data Security Standard and management's defined technology controls to support internal controls over financial reporting. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness, including network penetration assessments. The results of such assessments, audits, and reviews are reported to the Audit Committee of the Board and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Also see "Information Security, Cybersecurity, Data Privacy, Regulatory and Legal Risks" included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Incident Response Plan We have established a Cybersecurity Incident Response Policy ("CIRP"), which details the steps to be followed to properly respond to, contain, and remediate a cybersecurity incident. The CIRP provides a process for escalating certain cybersecurity incidents to the Board and members of management to facilitate management-level consideration as to whether a cybersecurity incident may be material to the Company and whether public disclosure of the incident is required.


text: The Company's Board of Directors is actively engaged in oversight of cybersecurity, and it is part of the responsibilities of our Audit Committee. The Company's Chief Technology and Information Officer (CTIO) and Chief Executive Officer keep the Board informed on cybersecurity and privacy matters throughout the year, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CTIO and our Vice President IT Risk Management. The Company's CTIO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. To facilitate the success of the Company's cybersecurity risk management program, we have a unified and centrally coordinated team, led by our Vice President IT Risk Management, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with senior leadership and other teams across Ulta Beauty. Reporting to our Vice President IT Risk Management are a number of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.