text: In addition, we maintain specific policies and practices governing our third-party security risks, including our third-party assessment process. Under this assessment process, we gather information from certain third parties who contract with us and share or receive data, to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data. We assess the risks from cybersecurity threats that impact select third-party service providers with whom we share personal identifying and confidential information. We continue to evolve our oversight processes to mature how we identify and manage cybersecurity risks associated with the services we procure from such third parties.


text: Our cybersecurity awareness program includes regular phishing simulations, and quarterly general cybersecurity awareness and data protection modules for all employees with network access, as well as more contextual and personalized modules for targeted users and roles. We complete annual internal security audits and vulnerability assessments of the Company's information systems and related controls, including systems affecting personal data. In addition, we leverage cybersecurity specialists to complete annual external audits and objective assessments of our cybersecurity program and practices, including our data protection practices, as well as to conduct targeted attack simulations. We have also purchased network security and cyber liability insurance in order to provide a level of financial protection, should a data breach occur. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: In 2023, we did not experience any material information security breach or incident. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A. "Risk Factors—Failure to effectively utilize information technology systems or implement new technologies and the unauthorized disclosure of personal or sensitive data or confidential information, whether through a breach of our computer system or otherwise, could severely disrupt our business or reduce our sales or profitability" and "Compromises, interruptions or shutdowns of our information technology systems, including those managed by third parties, whether intentional or inadvertent, could lead to delays in our business operations and, if significant or extreme, affect our results of operations."

stage1Category: Strategy Integration

stage1Method: majority


text: Our board of directors reviews our management of cybersecurity risks, and our Audit Committee has been delegated primary oversight over such risks and the steps our management has taken to monitor and control these exposures. Our data privacy and security program is overseen by our IT Director who has presented to the Board on an annual basis. Our Audit Committee also receives briefings on significant cybersecurity incidents.

stage1Category: Board Governance


text: Our IT Director leads our dedicated Information Technology team ("IT team"), which executes on our data privacy and security programs and policies, and our Cyber Incident Response Team ("IRT"), which executes on our incident response procedures in the event of a data privacy or security event and conducts annual exercises simulating cybersecurity and data breach incidents. The IRT is comprised of internal members from the finance, legal, human resources, and operations departments, as well as external cybersecurity vendors and advisors. The members of our IRT understand the complexities of our business and are experienced in the financial, legal, regulatory and operational consequences of a cybersecurity incident or threat to the Company.

stage1Category: Management Role


text: Our IT Director is Joe Rogers. He has 35 years of experience in information technology and cybersecurity, having been at the Company in his role as IT Director since 2022.


text: Risk Management and Strategy Our cybersecurity strategy focuses on striking a balance between data barriers and access, and promoting vigilance among our employees, contractors, and business partners. We monitor and implement procedures, policies, and activities designed to manage our data and to maintain a high level of privacy and security within our systems. In 2024, we continued the development of our enterprise risk program, which integrates cybersecurity.


text: Our cybersecurity processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implemented risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have an information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other standards and regulations. Our program includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls.


text: Through our cybersecurity program, we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats.


text: In 2024, we did not experience any material cybersecurity incident. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A. "Risk Factors—The unauthorized access to our information technology systems or the disclosure of personal or sensitive data or confidential information, whether through a breach of our computer system or otherwise, could severely disrupt our business or reduce our sales or profitability" and "Failure of our information technology systems, including those managed by third parties, whether intentional or inadvertent, could lead to delays in our business operations and, if significant or extreme, affect our results of operations."

stage1Category: None/Other


text: Our board of directors reviews our management of cybersecurity risks, and our Audit Committee has been delegated primary oversight of such risks and the steps our management has taken and takes to monitor and control these exposures. Our data privacy and security program is overseen by our Vice President of IT, who presents to the Board on an annual basis. Starting in 2024, our Board receives quarterly briefings on cybersecurity matters and the Company's efforts to prevent, detect, mitigate, and remediate cybersecurity risks. Our Audit Committee also receives regular briefings on cybersecurity matters, including cybersecurity threats and receives details on any significant cybersecurity incidents.


text: Our Vice President of IT leads our dedicated Information Technology team ("IT team"), which executes on our data privacy and information security programs and policies, and our Cyber Incident Response Team ("IRT"), which executes on our incident response procedures in the event of a data privacy or security event and conducts annual exercises simulating cybersecurity and data breach incidents. The IRT is comprised of internal members from the finance, legal, human resources, and operations departments, as well as external cybersecurity vendors and advisors. The members of our IRT understand the complexities of our business and are experienced in the financial, legal, regulatory and operational consequences of a cybersecurity incident or threat to the Company.


text: The IT team is led by Shoals' Vice President of IT, Gerald Jowers, who joined in 2024 with 30 years of technology experience.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to robots, employees or customers; violation of privacy or security laws and other litigation, legal and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: As part of these processes, and to ensure confidentiality, integrity and availability of critical data and systems, we have implemented various technologies that aid in the prevention, detection, investigation, response and remediation of vulnerabilities, cybersecurity incidents and risks. These technologies and processes include, but are not limited to, mobile device management, virtual private network security services, attack surface management services, cloud threat detection and response systems, cloud security posture management solutions, cloud-native security scanners and source code analysis tooling, continuous compliance monitoring and security awareness training solutions.


text: Evaluation and mitigation of Third-party risks are included within our broader overall risk assessment process. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and where necessary, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. Please see the risk factor entitled "We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our products and data processed by us or third-party vendors.." in Part I, Item 1A. Risk Factors in this report for more information.


text: The security and infrastructure teams are responsible for the continuous monitoring, reporting and response to threats and vulnerabilities discovered through the deployment and operation of these tools. As part of our risk management strategy, our cybersecurity team conducts routine vulnerability and risk assessments within our product operations and service environments. The results of these reviews and any incidents identified by security tooling are reported to senior management and the internal steering committee as part of the quarterly reporting process. As part of routine security assessments, if any deficiencies relating to internal technology controls over financial reporting are discovered, the VP of Security is required to report them directly to the executive management team and internal steering committee without delay.


text: In the last three fiscal years, we are not aware of and have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We have not been faced with any penalties or settlements related to cybersecurity.


text: Cybersecurity Governance Our internal steering committee and board of directors oversees our risk management strategies and processes, regarding risk assessment and risk management as they relate to cybersecurity. Our security team is led by our VP of Security who has over 15 years of direct cybersecurity experience that includes incident response, security operations and management. The security and infrastructure teams are responsible for implementing and maintaining cybersecurity and data protection controls and practices for the protection of our robots, customer and company information, systems and data. The VP of Security in coordination with our internal steering committee, whose members include professionals from our executive team, general counsel, product and technology and finance teams, meet quarterly to review our Cybersecurity risk exposure, discuss internal and external threat actors and prioritize remediation strategies. The internal steering committee makes decisions on the avoidance, transference, acceptance and mitigation of our overall cybersecurity risk exposure.


text: Our steering committee, typically in joint session with the full board of directors, meets quarterly with Serve executive leadership to receive reports regarding our overall security posture. These reports include updates on the implementation of cybersecurity controls, data security, risk assessments, the status of internal cybersecurity projects, technology compliance, employee awareness training and any notable incidents and remediation that have occurred within the quarter.


text: We also engage third-party providers to bolster our cybersecurity risk management and strategy. Some provide ongoing assistance, including threat monitoring, mitigation strategies, and updates on emerging trends. Others provide targeted expertise, such as security assessments and forensic analysis.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: Risk Management and Strategy Our Cybersecurity Program ("Program") is designed from a risk- and compliance-based approach for resilience and protection across our operations and the appropriate access, use, and/or disclosure of PHI and PII. Our Program employs the National Institute of Standards Technology (NIST) cybersecurity framework and strategy to deliver multi-layered defenses and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources to inform our cybersecurity efforts and allocate resources.

companyName: InnovAge Holding Corp.

ticker: INNV


text: We maintain our Program with physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and respond to cybersecurity incidents. Elements of our Program include: (i) required training for our employees (including onboarding and annual training), exercises (including advanced phishing exercises), and awareness for our employees to promote vigilance of cybersecurity risks and (ii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually. In addition, we engage various third-party consultants to assist us in assessing, enhancing, implementing and monitoring our Program and responding to incidents.


text: As a company managing the use and disclosure of PHI and PII, we annually undergo internal and/or third-party HIPAA Security Rule risk assessments of our administrative, physical, and technical safeguards. In addition, external assessors periodically evaluate our safeguards against multiple frameworks, including NIST Cyber Security Framework (CSF).


text: Our Program is integrated into our Enterprise Risk Management (ERM) program and includes a vendor risk management program supported by our security and compliance teams. We assess vendor cybersecurity risks according to HIPAA and NIST CSF standards and have established an oversight process to manage cybersecurity risks related to the products and services we procure.


text: During the fiscal year ended June 30, 2024, we did not identify risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. See "Security breaches, loss of data and other disruptions have in the past and could in the future compromise sensitive information related to our business or our participants, or prevent us from accessing critical information and expose us to liability, and could adversely affect our business and our reputation" in Item 1A "Risk Factors" in this Annual Report.


text: While our full Board of Directors has overall responsibility for risk oversight, it has delegated primary oversight of certain risks to its committees. Our Audit Committee monitors cybersecurity risks, and the steps our management has taken to monitor and control exposures. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) brief the Audit Committee quarterly on cybersecurity risks, updates on the regulatory and cyber landscape and significant cybersecurity events, as needed. Our Audit Committee reports to the Board of Directors on cybersecurity matters quarterly, or more often as the need arises.


text: We have an Information Security Team to strengthen our cybersecurity risk management activities across the Company. The Information Security Team reports to our CISO who works in collaboration with our CIO, Chief Compliance Officer and General Counsel. The Information Security Team is responsible for the oversight and operation of our Program, and the management our security standards and operating procedures.


text: Cole Naus is our CISO. Mr. Naus has over 10 years of experience in the cybersecurity industry. Mr. Naus holds a degree in Cybersecurity and Information Assurance and holds other cybersecurity certifications. Mr. Naus reports directly to Cara Babachicos, our CIO. Ms. Babachicos has over 20 years of experience in the cybersecurity industry, having previously worked as Chief Information Officer at other companies in the healthcare industry.


text: Risk Management and Strategy Our Cybersecurity Program ("Program") is designed from a risk- and compliance-based approach for resilience and protection across our operations and the appropriate access, use, and/or disclosure of PHI and PII. Our Program employs the National Institute of Standards Technology (NIST) Cybersecurity Framework (CSF) and strategy to deliver multi-layered defenses and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources to inform our cybersecurity efforts and allocate resources.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information about the cybersecurity risks we face, see the risk factors in Item 1A- Risk Factors.

companyName: MeridianLink, Inc.


text: We maintain our Program with physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and respond to cybersecurity incidents. Elements of our Program include: (i) required training for our employees (including onboarding and annual training), exercises (including advanced phishing exercises), and awareness for our employees to promote vigilance of cybersecurity risks, including those that may be exacerbated by artificial intelligence, and (ii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually. In addition, we engage various third-party consultants to assist us in assessing, enhancing, implementing and monitoring our Program and responding to incidents.


text: As a company managing the use and disclosure of PHI and PII, we annually undergo internal and/or third-party HIPAA Security Rule risk assessments of our administrative, physical, and technical safeguards. In addition, external assessors periodically evaluate our safeguards against multiple frameworks, including NIST CSF.


text: Our Program is integrated into our Enterprise Risk Management (ERM) program and includes a vendor risk management program supported by our security and compliance teams. We assess vendor cybersecurity risks according to HIPAA and NIST CSF standards and have established an oversight process which we periodically review to manage cybersecurity risks related to the products and services we procure.


text: During the fiscal year ended June 30, 2025, we did not identify risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. See "Security breaches, loss of data and other disruptions have in the past and could in the future compromise sensitive information related to our business or our participants, or prevent us from accessing critical information and expose us to liability, and could adversely affect our business and our reputation " in Item 1A "Risk Factors" in this Annual Report.


text: While our full Board has overall responsibility for risk oversight, it has delegated primary oversight of certain risks to its committees. Our Audit Committee monitors cybersecurity risks, and the steps our management has taken to monitor and control exposures. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) brief the Audit Committee quarterly on cybersecurity risks, updates on the regulatory and cyber landscape and significant cybersecurity events, as needed. Our Audit Committee reports to our Board on cybersecurity matters quarterly, or more often as the need arises.


text: We have an Information Security Team to strengthen our cybersecurity risk management activities across the Company, with its members having experience in public and private companies within the healthcare industry, as well as various cybersecurity certifications. The Information Security Team reports to our CISO who works in collaboration with our CIO, Chief Compliance Officer and General Counsel. The Information Security Team is responsible for the oversight and operation of our Program, and the management our security standards and operating procedures.


text: Risk Management and Strategy The Company has adopted policies, processes, procedures and standards and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Cybersecurity Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework.

companyName: N-able, Inc.

ticker: NABL


text: The Company's processes are integrated into its overall enterprise risk management program, which includes financial risk, compliance risk and other strategic and operational risks that affect the Company. The processes compliment the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Cybersecurity Committee. In designing these processes, the Company takes into account industry frameworks such as the National Institute of Standards and Technology (NIST), Committee of Sponsoring Organizations (COSO), and International Organization for Standardization (ISO) 27001, and other industry standards. To further improve the effectiveness of its cybersecurity risk management framework, the Company has in the past, and may continue to do so in the future, engage third party consultants, to assist in testing and evaluating our security program.


text: The Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: We have a formalized incident response plan (IRP) and associated procedures based on cybersecurity best practices which are refined using the information gained through testing and to further improve our cybersecurity preparedness and response infrastructure. These plans and procedures set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.


text: We review our cybersecurity risk framework and related policies annually with our senior management to help identify areas for continued focus and improvement. We also engage third parties to review and assess our processes annually. Our information security management system has been independently certified as being in conformity with ISO/IEC 27001:2013.


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. The Company works with such providers to recommend securities measures to be improved where possible, and generally requires those third parties that could introduce significant cybersecurity risk to us to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

stage1Category: Third-Party Risk


text: Although we have not experienced any material cybersecurity incidents since becoming a stand-alone public company in July 2021, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, including the Cyber Incident, have affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled "Cyberattacks, including the Cyber Incident, and other security incidents have resulted, and in the future may result, in compromises or breaches of our, our MSP partners', or their SME customers' systems, the insertion of malicious code, malware, ransomware or other vulnerabilities into our, our MSP partners', or their SME customers' systems, the exploitation of vulnerabilities in our, our MSP partners', or their SME customers' environments, the theft or misappropriation of our, our MSP partners', or their SME customers' proprietary and confidential information, and interference with our, our MSP partners', or their SME customers' operations, exposure to legal and other liabilities, higher MSP partner and employee attrition and the loss of key personnel, negative impacts to our sales, renewals and upgrades and reputational harm and other serious negative consequences, any or all of which could materially harm our business" and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, MSP partner and employee relations, results of operations, financial condition or cash flows" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Role of the Board of Directors and the Cybersecurity Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management program, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Cybersecurity Committee of the Board, or the Cybersecurity Committee. The Cybersecurity Committee is responsible for overseeing our information technology systems and cybersecurity risks, including plans and programs relating to cyber and data security and legal and regulatory risks associated with our products and business operations. The Cybersecurity Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly, which covers topics including, among others, recent cybersecurity risk landscape and trends, data security posture, results from third-party assessments, training and vulnerability testing, our cybersecurity and compliance program, critical cybersecurity risks, as well as the steps management has taken to respond to such risks, emerging cybersecurity regulations, technologies and best practices. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.


text: Role of Management, Our Security Risk Committee ("SRC"), comprised of our Chief Security Officer ("CSO"), our Chief Legal Officer and representatives from the technology and product, people, IT and legal teams, is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CISO works with the SRC to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: Our board of directors is aware of the importance of managing the evolving and complex cybersecurity threat landscape, and has established oversight measures designed to manage associated cybersecurity risks. The Cybersecurity Committee is a decision-making body formed by our board that is tasked with advising and assisting the Chief Information Security Officer, or CISO, on cybersecurity matters and integrating major cybersecurity initiatives into our broader strategy. The Cybersecurity Committee is composed of board members whose backgrounds collectively include experience in risk management, technology, and finance.


text: The CSO manages a team that is responsible for day-to-day tracking, assessing and management of threats. The N-able security team has a dedicated incident response team, with trained resources that are responsible for the various stages of our incident management strategy, including preparation, detection and analysis, containment, eradication, and recovery. Through ongoing communications with the team, the CSO and the SRC are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity infrastructure initiatives. In the event of a material cybersecurity incident or investigation, management will, in accordance with the Company's IRP and other policies in place, promptly report to the Cybersecurity Committee and the Board, as appropriate. This escalation is in addition to the regular reports by the CSO to the Cybersecurity Committee on at least an annual basis.


text: Our CSO has served as such since 2021, and has over 20 years of experience in various roles in information security, including serving as an IT security leader at AT&T/Warner Media, where he implemented an extensive security program managing complex incident response events. He holds a degree in Information Technology.


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. The Company engages a third-party to perform 24/7 monitoring for threats and unauthorized access to our information security network.


text: Although we have not experienced any material cybersecurity incidents since becoming a stand-alone public company in July 2021, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, including the Cyber Incident, have affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled "Cyberattacks, including the Cyber Incident, and other security incidents have resulted, and in the future may result, in compromises or breaches of our, our IT services provider customers', or their SMB and mid-market customers' systems, the insertion of malicious code, malware, ransomware or other vulnerabilities into our, our IT services provider customers', or their SMB and mid-market customers' systems, the exploitation of vulnerabilities in our, our IT services provider customers', or their SMB and mid-market customers' environments, the theft or misappropriation of our, our IT services provider customers', or their SMB and mid-market customers' proprietary and confidential information, and interference with our, our IT services provider customers', or their SMB and mid-market customers' operations, exposure to legal and other liabilities, higher customer and employee attrition and the loss of key personnel, negative impacts to our sales, renewals and upgrades and reputational harm and other serious negative consequences, any or all of which could materially harm our business" and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer and employee relations, results of operations, financial condition or cash flows" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Role of Management, Our Security Risk Committee ("SRC"), comprised of our Chief Security Officer ("CSO"), our Chief Legal Officer and representatives from the technology and product, people, IT and legal teams, is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CSO works with the SRC to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: Risk Management and Strategy We take seriously the security of the data entrusted to us by our customers and the confidentiality, integrity, and availability of our platforms. We have integrated cybersecurity risk management into our broader enterprise risk management framework in an effort to protect our applications, networks, and systems from risks from cybersecurity threats. This strategic integration allows cybersecurity risk management to inform early decision-making processes across the organization.


text: We recognize the ever-evolving nature of cybersecurity risks. Our cybersecurity risk management program leverages recognized industry standards and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework. MeridianLink also conducts periodic penetration testing and operates a bug bounty program to expose weaknesses in our applications, networks, and systems before they can be exploited by malicious actors. Our Governance, Risk, and Compliance, or GRC team, in close collaboration with our Security Operations and Engineering teams, monitors and mitigates evolving risks from cybersecurity threats, prioritizing alignment with our business objectives and operational needs. We view cybersecurity risk management as a shared responsibility, and at a management level, we periodically perform tabletop exercises which simulate real-world cyberattacks.


text: We also strategically partner with third-party cybersecurity consultants, assessors, and auditors in evaluating and testing our cybersecurity risk management processes and controls. These strategic partnerships are catalysts for the continuous improvement of our cybersecurity risk management posture. Through audits, threat assessments, and collaborative brainstorming sessions on cybersecurity enhancements, these collaborative partnerships help us bridge knowledge gaps, identify best practices and refine our cybersecurity strategies and processes. Further, we leverage these partnerships to identify cybersecurity vulnerabilities and weaknesses and improve our cybersecurity posture.


text: As part of our cybersecurity risk management program, we maintain processes to proactively manage potential risks posed by third-party vendors. This involves conducting cybersecurity assessments before onboarding any vendor that may have access to our systems, applications, or data, followed by ongoing monitoring by our GRC team and periodic assessments to evaluate these onboarded vendors' compliance with our cybersecurity standards.


text: Our CISO leads our cybersecurity risk management program. The individual currently serving in this role has over 20 years of experience designing and building cybersecurity programs, and his background spans multiple industries such as fintech, SaaS, energy/utilities, legal and managed security services. The CISO establishes and supervises procedures for the evaluation of our information systems, including the use of security tools and system reviews designed to spot potential weaknesses. The CISO works to keep up to date with the latest trends in cybersecurity, such as emerging risks and best practices for cybersecurity risk management. In case of a cybersecurity incident, the CISO initiates our incident response plan in an effort to respond to the incident and to reduce the potential damage to our organization.


text: The CISO briefs the Cybersecurity Committee on cybersecurity risks on at least a quarterly basis. These briefings encompass a range of topics, including, as appropriate, key cybersecurity metrics, the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, and incident management reports and lessons learned from cybersecurity events. The Cybersecurity Committee and CISO also maintain a continuous dialogue on potential threats. The Cybersecurity Committee annually assesses MeridianLink's cybersecurity posture and risk management efficacy, leading to improvement efforts. The Cybersecurity Committee chair and/or our General Counsel conveys certain cybersecurity updates on the CISO's behalf during board meetings.


text: Risk Management and Strategy We take seriously the security of the data entrusted to us by our customers and the confidentiality, integrity, and availability of our platforms. We have integrated cybersecurity risk management into our broader enterprise risk management framework in an effort to protect our applications, networks, systems, and sensitive data from the risks of cybersecurity threats. This strategic integration allows cybersecurity risk management to inform early decision-making processes across the organization.


text: We recognize the ever-evolving nature of cybersecurity risks. Our cybersecurity risk management program is informed by recognized industry standards and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework. MeridianLink also conducts periodic penetration testing and operates a bug bounty program in an effort to expose weaknesses in our applications, networks, and systems before they can be exploited by malicious actors. Our Governance, Risk, and Compliance, or GRC team, in close collaboration with our Security Operations and Engineering teams, monitors and mitigates evolving risks from cybersecurity threats, prioritizing alignment with our business objectives and operational needs. We view cybersecurity risk management as a shared responsibility, and at a management level, we periodically perform tabletop exercises which simulate real-world cyberattacks.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information about the cybersecurity risks we face, see the risk factors in Item 1A- Risk Factors.


text: Our CISO leads our cybersecurity risk management program. The individual currently serving in this role has over 20 years of experience assessing and improving cybersecurity programs, and his background spans multiple industries such as fintech, SaaS, critical infrastructure, legal, and federal, state, and local government. The CISO establishes and supervises procedures for the evaluation of our information systems, including the use of security tools and system reviews designed to spot potential weaknesses. The CISO works to keep up to date with the latest trends in cybersecurity, such as emerging risks and best practices for cybersecurity risk management. In case of a cybersecurity incident, the CISO initiates our incident response plan in an effort to respond to the incident and to reduce the potential damage to our organization.


text: The CISO briefs the Cybersecurity Committee on cybersecurity risks on at least a quarterly basis. These briefings encompass a range of topics, including, as appropriate, key cybersecurity metrics, the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, and incident management reports and lessons learned from cybersecurity events. The Cybersecurity Committee and CISO also maintain a continuous dialogue on potential threats. The Cybersecurity Committee annually assesses MeridianLink's cybersecurity posture and risk management efficacy. The Cybersecurity Committee chair and/or our General Counsel conveys certain cybersecurity updates on the CISO's behalf during board meetings.


text: Coupang has a cyber risk management framework designed to assess, identify, and manage cyber related risks. Cyber related risks are identified through audits, assessments, and incidents. Our vulnerability scanning process uses both automated tools and penetration testing to identify vulnerabilities within our environment.

companyName: Coupang, Inc.

ticker: CPNG


text: We seek to identify, manage and reduce the risks and potential vulnerabilities by integrating controls and solutions into technology projects based on severity and priority. The Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience at the Company and elsewhere, leads our global information security organization responsible for overseeing the Coupang information security program. The CISO regularly reviews our cyber strategy with technology leadership in order to assess whether the cyber strategy is integrated across the organization. The CISO receives reports on cybersecurity threats from experienced information security officers in our security organization on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. We conduct annual assessments by certified external third-party assessors as part of our industry-recognized information security certifications, ISMS-P and ISO 27001. We also periodically have external third-party consultants conduct maturity assessments of our Information Security program. The results of these audits and assessments inform us about possible risks which are managed through our enterprise risk management process. We also employ external third-party vendors to provide cyber threat intelligence when relevant information is available or as requested. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: The executive leadership team provides oversight and guidance on cyber policies, procedures, and strategies. Our Board of Director's role in risk oversight is consistent with our leadership structure, with the executive leadership team having responsibility for assessing and managing risks we face in executing our business plans, and the Board and its committees providing oversight in connection with those efforts. In addition to the full Board, the Audit Committee of the Board plays an important role in the oversight of our enterprise risk assessment and management activities, which identify key risks to our business, including risks related to cybersecurity, data privacy, and regulations, and assesses any steps taken to monitor and control such risk. The Audit Committee regularly meets with the CISO to discuss various cybersecurity matters including cyber strategy, cybersecurity risks, controls, including results of audits, mitigation strategies, areas of emerging risks, incidents, if any, and industry trends. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee through ongoing updates until resolution.


text: We seek to identify and manage risks from cyber threat intelligence and lessons learned from known cyber incidents with our cyber risk management process and include these within our cyber risk strategy through major technology enhancements and projects. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. Cybersecurity risks continue to increase, and as set out in our risk factors our services may be affected by cybersecurity and data security incidents, including but not limited to spyware, viruses, phishing, and other spam emails, denial of service attacks, data theft, computer intrusions, outages, and similar events, which could be material to the Company. See "Item 1A. Risk Factors" in this Form 10-K for additional discussion on the risks of future cyber incidents to our results of operations and financial condition.


text: Coupang has a cyber risk management framework designed to identify, assess, and manage cyber related risks. Cyber related risks are identified through self-identification, audits, assessments, and incidents. Our vulnerability scanning process uses both automated tools and penetration testing to identify vulnerabilities within our environment.


text: We seek to identify, manage and reduce the risks and potential vulnerabilities by integrating controls and solutions into information security and technology projects based on severity and priority.


text: We engage in the periodic assessment and testing of our processes that are designed to address cybersecurity threats and incidents, including with respect to third-party vendors. The results of such assessments are reported to management and the Board. Adjustments to our cybersecurity processes are made as necessary.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: EverCommerce Inc.

ticker: EVCM


text: The Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience at the Company and elsewhere, leads our global information security organization responsible for overseeing the Coupang information security program. The CISO regularly reviews our cyber strategy with technology leadership in order to integrate the cyber strategy across the organization. The CISO is updated on cybersecurity threats from experienced information security officers in our security organization on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Supporting the CISO, is the dedicated information security team, which comprises almost 200 individuals. In addition to full-time employees, external consultancy services provide us with certain information security services and specialized advice.


text: We conduct annual assessments by certified external third-party assessors as part of our industry-recognized information security certifications, ISO 27001, 27017, 27701, and ISMS-P. We periodically have external third-party consultants conduct maturity assessments of our Information Security program. The results of these audits and assessments inform us about possible risks which are managed through our enterprise risk management process. We employ external third-party vendors to provide cyber threat intelligence when relevant information is available or as requested. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, customer or otherwise implicating the third-party technology and systems we use. We also have a program of Cyber Tabletop exercises, run periodically, with key people in our business, to further enhance our capabilities to respond and recover to a cyber incident.


text: The Coupang executive leadership team provides oversight and guidance on cyber policies, procedures, and strategies. Our Board of Director's role in risk oversight is consistent with our leadership structure, with the executive leadership team having responsibility for assessing and managing risks we face in executing our business plans, and the Board and its committees providing oversight in connection with those efforts. In addition to the full Board, the Audit Committee of the Board plays an important role in the oversight of our enterprise risk assessment and management activities, which identify key risks to our business, including risks related to cybersecurity, data privacy, and regulations, and assesses any steps taken to monitor and control such risk. The Audit Committee regularly meets with the CISO to discuss various cybersecurity matters including cyber strategy, cybersecurity risks, controls, including results of audits, mitigation strategies, areas of emerging risks, incidents, if any, and industry trends. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee through ongoing updates until resolution.


text: We seek to identify and manage risks from cyber threat intelligence and lessons learned from known cyber incidents with our cyber risk management process and include these within our cyber risk strategy through major information security and technology enhancements and projects. As of the date of this 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. Cybersecurity threats continue to increase, and as set out in our risk factors our services may be affected by cybersecurity and data security incidents, which could be material to the Company. See "Item 1A. Risk Factors" in this Form 10-K for additional discussion on the risks of future cyber incidents to our results of operations and financial condition.


text: Our Board of Directors (the "Board") recognizes the importance of cybersecurity in today's digital landscape. We are committed to safeguarding our information systems and data assets. This enables us to maintain the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in overseeing our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity processes are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our risk management program, we actively work to identify, prevent and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur.


text: Risk Management and Strategy We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Maintaining a comprehensive International Organization for Standardization-based Information Security Policy. The Information Security Policy is reviewed and certified by our Vice President of Information Technology. • Inclusion of Sarbanes-Oxley Information Technology General Controls in our Risk and Control Matrix, which are routinely tested by our Internal Audit team. • Regular risk and vulnerability assessments to identify and address potential weaknesses in our systems. We primarily utilize in-house resources for assessing, identifying and managing cybersecurity threats. • Engaging external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cybersecurity defense capabilities and recommending steps to mitigate associated threats, reduce risk, enhance our cybersecurity posture and meet our evolving needs. • Routine screening of potential and existing third-party vendors to assess their cybersecurity posture and the incremental risk that they may pose to us. Third-party vendor access to critical information systems is subject to regular review and assessment by management, and management evaluates the cybersecurity risks and safeguards of potential third-party vendors prior to engaging such vendors. • Mandatory employee cybersecurity training to equip the employees with the tools and knowledge to enhance the cybersecurity posture across the organization. • Continuous monitoring of networks and systems for suspicious activity; leveraging firewalls; intrusion detection and prevention systems; endpoint anti-virus and anti-malware solutions; and a privileged access management system. • A comprehensive incident response plan, which has been developed to enhance the Company's ability to respond to, and recover from, cybersecurity incidents.


text: Through the aforementioned processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—We rely on information technology systems to support our business operations. A significant disturbance or breach of our technological infrastructure, or those of our vendors or others with which we do business, could adversely affect our financial condition and results of operations. Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation."


text: The Audit Committee is primarily responsible for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on cybersecurity risks, addressing matters such as evolving standards; vulnerability assessments, including results of third-party penetration testing; audits of our cybersecurity IT controls, and independent reviews of our cybersecurity processes. Management and the Board also receive prompt and timely information regarding any significant or potentially material cybersecurity incident and our remediation efforts.


text: Our Vice President, Information Technology, in coordination with management, works to implement our program to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of our cybersecurity risk management program, we have assigned dedicated resources, including our Vice President, Information Technology, and members of his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and provide reports to management, the Audit Committee and the Board on a regular basis and as needed in response to specific incidents.


text: Our Vice President, Information Technology, has served in various roles in information technology and information security for over 20 years, the majority of which has involved leading IT transformation, cybersecurity and compliance programs at public companies. He holds an undergraduate degree in industrial engineering and an MBA and has attained multiple cybersecurity-related certifications including the Certified Information Systems Security Professional.


text: Risk Management and Strategy We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Maintaining a comprehensive International Organization for Standardization-based Information Security Policy. The Information Security Policy is reviewed and certified by our Vice President of Information Technology. • Inclusion of Sarbanes-Oxley Information Technology General Controls in our Risk and Control Matrix, which are routinely tested by our Internal Audit team. • Regular risk and vulnerability assessments to identify and address potential weaknesses in our systems. We primarily utilize in-house resources for assessing, identifying and managing cybersecurity threats. • Engaging external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cybersecurity defense capabilities and recommending steps to mitigate threats, enhance our cybersecurity posture and meet our evolving needs. • Routine screening of potential and existing third-party vendors to assess their cybersecurity posture and the incremental risk that they may pose to us. Third-party vendor access to critical information systems is subject to regular review and assessment by management, and management evaluates the cybersecurity risks and safeguards of potential third-party vendors prior to engaging such vendors. • Mandatory employee cybersecurity training to equip our employees with the tools and knowledge to enhance the cybersecurity posture across the organization. • Continuous monitoring of networks and systems for suspicious activity, leveraging firewalls, intrusion detection and prevention systems, endpoint anti-virus and anti-malware solutions, and a privileged access management system. • A comprehensive incident response plan, which has been developed to enhance the Company's ability to respond to, and recover from, cybersecurity incidents.


text: Through these processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—We rely on information technology systems to support our business operations. A significant disturbance or breach of our technological infrastructure, or those of our vendors or others with which we do business, could adversely affect our financial condition and results of operations. Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation."


text: The Audit Committee is primarily responsible for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on cybersecurity risks, addressing matters such as evolving standards; vulnerability assessments, including results of third-party penetration testing; audits of our cybersecurity IT controls; and independent reviews of our cybersecurity processes. Management and the Board also receive prompt and timely information regarding any significant or potentially material cybersecurity incident and our remediation efforts.


text: Our Board of Directors (the "Board") and management recognize the importance of maintaining the trust and confidence of our clinical trial participants, investors, business partners and employees. The Board and the Audit Committee of the Board (the "Audit Committee") are actively involved in oversight of our cybersecurity program as part of our approach to risk management. Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework. In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, integrity, security, and availability of our critical systems and the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: Risk Management and Strategy We design and assess our program based on the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • The utilization of Microsoft 365 services for email, data storage, Identity Provider ("IdP") for Single Sign-On ("SSO"), and other technical controls such as remote user and device management; • Microsoft 365 configurations which are aligned with security and industrial standards, including automatic risk management mechanisms and alert notifications for our Information Technology ("IT") team; • A zero trust approach to cybersecurity focused on preventing and limiting damage in the event that a malicious actor gains access to our network and operating on the principle "never trust, always verify," continuously authenticating and authorizing users and devices that seek to obtain access to our systems and data; • Privileged access management protocols that require user access requests to receive formal, documented approvals with specific business justifications and, following receipt of such approvals, the provision of only the minimum access necessary for the approved purpose; • Regular monitoring of our Microsoft security score, which serves as a benchmark for our security posture and guides our continuous improvement efforts; • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, including annual external assessments and vulnerability scanning; • A security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • Regular security awareness training sessions for users, including simulated phishing email campaigns managed by KnowBe4, a third-party leader in security awareness training; • A disaster recovery program, including business continuity procedures in the event of a disaster, backup procedures, failover features with up-to-date SaaS services, and data recovery protocols; and • A third-party risk management ("TPRM") process to safeguard against risks posed by service providers, suppliers and vendors, based on our assessment of their respective criticality to our operations and respective risk profile, encompassing risk identification, due diligence and risk assessment prior to engagement, and categorization of third parties based on risk levels.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We did not experience any material IT security incidents during the fiscal year. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our IT Systems, or those of our CROs, CMOs, other contractors, vendors, consultants or collaborators, may fail or suffer system failures, security breaches or deficiencies in cybersecurity, which could results in a material disruption of our product development programs, compromise sensitive information related to our business or trigger contractual and legal obligations.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal staff as part of the Board's continuing education on topics that impact public companies.


text: Our Director of Information Technology, who reports to our principal financial officer, leads the operational oversight of Company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess, manage, and help prepare us and our directors and employees to address, cybersecurity risks. Specific cybersecurity related responsibilities of the Director of Information Technology include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Director of Information Technology has over 25 years of diverse experience in information technology, including management roles at managed service providers, enabling him to effectively oversee cybersecurity risks and threats.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors has delegated to the Audit Committee to be actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are in the process of being fully integrated into our ERM program and are based on recognized frameworks and applicable industry standards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information systems that we use and the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Vizio Holding Corp.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Steering Committee and the Audit Committee, and we evaluate potential adjustments to our cybersecurity policies, standards, processes and practices as reasonably necessary based on the information provided by these assessments, audits and reviews. We also provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The Risk Management Steering Committee includes our Chief Financial Officer ("CFO"), General Counsel ("GC"), Senior Vice President, Operations and Technical Support ("SVP-Ops"), Senior Vice President, Engineering ("SVP-Engineering") and Group Vice President, Information Technology ("GVP-IT") and other business unit representatives and subject matter experts, who regularly interact with our ERM function. The Risk Management Steering Committee works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents.


text: The Audit Committee, in coordination with the Risk Management Steering Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee and the Risk Management Steering Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Risk Management Steering Committee promptly receives information regarding cybersecurity incidents and elevates information to the Audit Committee about incidents when appropriate, as well as ongoing updates regarding any such incident until it has been addressed. The Audit Committee also receives routine executive reports on cybersecurity risk management from the GC, SVP-Ops and GVP-IT. On an annual basis, the Board of Directors discusses our approach to cybersecurity risk management with a representative of the Risk Management Steering Committee.


text: Each member of the Risk Management Steering Committee, including the business unit representatives and subject matter experts, has substantial experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats. Through ongoing communications with these teams, the CFO, GC and the rest of the Risk Management Steering Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: As of the date of this report, we have not been materially affected by any cybersecurity threats, including as a result of any previous cybersecurity incidents. For more detailed information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including "Risks Relating to Legal and Regulatory Matters: A breach of the confidentiality or security of information we or our third-party providers hold or of the security of the computer systems used in or for our business could be detrimental to our business, financial condition and results of operations."


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, and have implemented processes for our systems taking guidance from recognized cybersecurity frameworks, such as U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") in an effort to mitigate risks. As part of these proactive measures, we maintain a Cybersecurity Incident Response and Escalation Process with defined roles, responsibilities, and reporting protocols that is periodically reviewed, tested, and updated. The Company has an Executive Cyber Response and Disclosure Committee (consisting of senior executives from the business, finance, operations and legal functions), which is responsible for determining what actions are necessary to respond to cybersecurity events, with input from the Chief Information Security Officer and other subject matter experts directly participating in incident response efforts.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Additionally, on a quarterly basis, our Audit Committee receives reports from the Chief Information Officer, Chief Information Security Officer, and other members of management. As part of its annual assessment, the Audit Committee evaluates significant risks related to our business including cybersecurity risks, and provides such information to our Board of Directors. Our Internal Audit Group also reviews our cybersecurity governance and controls annually.


text: Our cybersecurity risk management program encompasses periodic risk assessments, designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment. More specifically, an independent third-party performs a regular penetration test of Marvell's IT infrastructure. In addition to our penetration testing, an independent third-party security firm is engaged to perform additional security controls testing and provide an independent report to our executive team. This external assessment provides us and our Audit Committee with a comprehensive evaluation of our security posture.


text: Our information security team plays a pivotal role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents—whether they originate internally or from our vendors, suppliers or other third parties that we conduct business with. As part of our vendor selection process, we evaluate cybersecurity risks in appropriate situations. Furthermore, we conduct tabletop exercises periodically. These simulations allow us to test our response strategies across various business functions, allowing preparedness for real-world incidents. When risks are identified through our processes, we analyze their potential impact on the Company and assess the likelihood of occurrence. Our monitoring efforts help us to timely mitigate and remediate risks and incidents. As part of our commitment to security awareness, information security training is mandatory for every employee and contractor. This ongoing compliance program reinforces best practices and helps to foster a security-conscious culture.


text: To safeguard our systems, we regularly install and update anti-malware and endpoint detection and response software across all IT-managed systems and workstations. These measures help detect and prevent malicious code from compromising our infrastructure.


text: We also engage third-party providers to bolster our cybersecurity risk management and strategy. Some provide ongoing assistance, including threat monitoring, mitigation strategies, and updates on emerging trends. Others provide targeted expertise, such as security assessments and forensic analysis.


text: Third Party Security Experts We engage third party security experts to supplement our internal CWG team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts provide guidance to support our cybersecurity efforts. We use the findings of these third-party experts to improve our practices, procedures, and technologies. We also engage as necessary third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Cybersecurity Governance Our Board of Directors considers cybersecurity and other information technology risk as part of its risk oversight function. The Audit Committee receives quarterly reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks and risk management program. Our cybersecurity team, led by our CISO, who reports directly to our Executive Vice President and Chief Operations Officer, is responsible for assessing and managing risks from cybersecurity threats. The CISO and his team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and any retained external cybersecurity experts. Our CISO has over 20 years of security experience managing global security organizations including architecture, operations, strategy, applications, infrastructure, support and execution. The information security team collectively have decades of relevant experience in the industry and many hold various cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Further, we invest in regular, ongoing cybersecurity training for our team.


text: The CISO reports such cybersecurity threats and incidents to the Audit Committee. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee. In addition, pursuant to our internal procedures, in the event of a significant cybersecurity incident, members of senior management will report such threats and incidents in a timely manner directly to the Audit Committee and, when appropriate, to the full Board of Directors.


text: We, like other technology companies operating in the current environment, have experienced cybersecurity incidents, but in the last three years we have not experienced an incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Cybersecurity risks could adversely affect our business and disrupt our operations" in Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, and have implemented processes for our systems taking guidance from recognized cybersecurity frameworks, such as U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") in an effort to mitigate risks. As part of these proactive measures, we maintain a Cybersecurity Incident Response and Escalation Process with defined roles, responsibilities, and reporting protocols that is periodically reviewed, tested, and updated. The Company has an Executive Cyber Response and Disclosure Committee (consisting of senior executives from the business, finance, operations and legal functions), which is responsible for determining what actions are necessary to respond to cybersecurity events, with input from the Chief Security Officer ("CSO") and other subject matter experts directly participating in incident response efforts. Furthermore, we conduct an annual full board briefing on cybersecurity, ensuring that our Board of Directors is regularly informed of the evolving landscape of cybersecurity risks and mitigation strategies.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Additionally, on a quarterly basis, our Audit Committee receives reports from the Chief Information Officer, CSO, and other members of management. As part of its annual assessment, the Audit Committee evaluates significant risks related to our business including cybersecurity risks, and provides such information to our Board of Directors. Our Internal Audit team also reviews our cybersecurity governance and controls annually.


text: Our cybersecurity risk management program encompasses periodic risk assessments, designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment. More specifically, an independent third-party performs a regular penetration test of our IT infrastructure. In addition to our penetration testing, an independent t hird-party security firm is engaged to perform additional security controls testing and provide an independent report to our executive team. This external assessment provides us and our Audit Committee with a comprehensive evaluation of our security posture.


text: Our information security team plays a pivotal role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents—whether they originate internally or from our vendors, suppliers or other third parties that we conduct business with. As part of our vendor selection process, we evaluate cybersecurity risks in appropriate situations. Furthermore, we conduct tabletop exercises periodically. These simulations allow us to test our response strategies across various business functions, increasing preparedness for real-world incidents. When risks are identified through our processes, we analyze their potential impact on the Company and assess the likelihood of occurrence. Our monitoring efforts help us to timely mitigate and remediate risks and incidents. As part of our commitment to security awareness, information security training is mandatory for every employee and contractor. This ongoing compliance program reinforces best practices and helps to foster a security-conscious culture.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity and other information technology risk as part of its risk oversight function. The Board of Directors receives an annual briefing, and the Audit Committee receives quarterly reports from our CSO on our cybersecurity risks and risk management program. Our cybersecurity team, led by our CSO, who reports directly to our Executive Vice President and Chief Operations Officer, is responsible for assessing and managing risks from cybersecurity threats. T he CSO and his team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and any retained external cybersecurity experts. Our CSO has over 20 years of security experience managing global security organizations including architecture, operations, strategy, applications, infrastructure, support and execution. The information security team collectively have decades of relevant experience in the industry and many hold various cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Further, we invest in regular, ongoing cybersecurity training for our team.


text: The CSO reports cybersecurity threats and incidents to the Audit Committee. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee. In addition, pursuant to our internal procedures, in the event of a significant cybersecurity incident, members of senior management will report such threats and incidents in a timely manner directly to the Audit Committee and, when appropriate, to the full Board of Directors.


text: We, like other technology companies operating in the current environment, have experienced cybersecurity incidents, but in the last three years we have not experienced an incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Cybersecurity risks could adversely affect our business and disrupt our operations" in Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a Cybersecurity Working Group ("CWG") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we have a CWG which is responsible for monitoring both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.


text: We have outlined preliminary policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities for preliminary assessment, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our policies and procedures include processes which incorporate regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through an internal reporting channel.


text: Risk Management Process Integration Our risk management processes, including Cybersecurity, are overseen by the Audit Committee of our board of directors. Our processes include ongoing information technology risk assessments, and third-party security risks assessments.


text: Our cybersecurity risk management efforts have also been integrated into the overall risk management process, which includes assessment of cybersecurity risks that could result in significant operational disruption to the Company, such as business downtime, loss of Company's financial assets or other operation interruptions, as well as risks that could have significant reputational and compliance/regulatory impact. Cybersecurity risks identified and tracked through our risk management process have assigned risk owners at the executive leadership level and risk delegates who are responsible to identify and manage risk mitigation actions. Key risk indicators are updated periodically and communicated to our executive leadership.


text: We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, and program enhancements. We also include cybersecurity training as part of our required annual employee training program. In addition, cybersecurity and privacy training and awareness is integrated and continues throughout the year, utilizing various delivery methods such as phishing campaigns, training sessions, and informational articles.


text: Identification of Threats Associated with Third Parties We utilize an internal risk management process to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. We conduct initial risk assessments of key third-party suppliers and service providers based on various factors to classify each into a risk category. Our process is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of key third-party suppliers and service providers that have access to our networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their cybersecurity controls. We also require that our key suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.


text: Incidents and Risks Nuvve Holding Corp. has not experienced a material cybersecurity incident. Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Technology, Intellectual Property, and Infrastructure" identified in the "Risk Factors" section of Part 1 of Item 1A herein.


text: Board of Directors Oversight responsibilities for our cybersecurity and digital trust compliance programs and risks lie with the Audit Committee of our board of directors. Our board of directors have the ultimate oversight responsibilities of our cybersecurity program and all operational, financial, strategic, and reputational risks with oversight of specific risks undertaken with the committee structure including risks related to cybersecurity, privacy, and technology.


text: The Audit Committee receives reports on the Company's cybersecurity program and developments from our CWG, at our regular meetings, at least once a year or as needed. These reports typically include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status, as well as a review of our key third-party service providers. Our digital technology, legal, and the corporate audit functions also routinely present to the Audit Committee on key cybersecurity topics and, on at least an annual basis, the Board receives reports on the Company's cybersecurity program and developments from the CWG.


text: Our programs are focused on building digital trust through sound oversight of cybersecurity and data privacy protections and the responsible use of data and technology. We operate a CWG, and we have a cross-functional approach to addressing cybersecurity-related risks through the functional compliance structures in our digital technology.


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital trust compliance programs, with active participation in the CWG. The CWG is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CWG also develops periodic reports on the Company's cybersecurity program and developments. The CWG members include the Chief Operating Officer, Chief Financial Officer, and Vice President of Technology.


text: The Chief Operating Officer is National Association of Corporate Directors ("NACD") Directorship Certified and has earned the NACD certificate in cyber risk oversight.


text: Our policies and procedures include the establishment of an Incident Response Team ("IRT") that consists primarily of representatives from the CWG, legal, corporate communications, finance, and other relevant stakeholders. The IRT follows the guidance as outlined in the IRP to respond to cybersecurity incidents and escalate as necessary to the CWG based on a defined severity matrix. The senior executive leadership stakeholders are responsible for assessing the materiality of risks in consultation with the IRT, CWG, and external advisors.


text: We have policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities for preliminary assessment, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our policies and procedures include processes which incorporate regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through an internal reporting channel.