text: Cybersecurity Risk Management and Strategy We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, any cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate such incidents as well as to comply with applicable legal obligations.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: We engage certain external parties to enhance our cybersecurity processes and strategies. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture of such providers according to the perceived level of risk and in accordance with industry standard best practices.

secItem: Item 1C

stage1Category: Third-Party Risk

stage1Method: unanimous


text: The Audit Committee of the board of directors provides direct oversight over cybersecurity risk and provides regular updates to the board of directors regarding such oversight. The Audit Committee regularly meets with members of management responsible for data privacy, technology, and information security risks to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.


text: Our Senior Director of Information Technology and Cyber Security, who reports to our Chief Financial Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities of the Senior Director of Information Technology and Cyber Security include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Senior Director of Information Technology and Cyber Security has over 25 years of diverse experience in information technology, including management roles at managed service providers, enabling him to effectively oversee cybersecurity risks and threats.

stage1Category: Management Role


text: In an effort to deter and detect cyber threats, we provide all employees, including any part-time employees, with a data protection, cybersecurity, and incident response and prevention training program designed to educate employees on the importance of identifying and reporting all potential data security incidents immediately. The training covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.

stage1Category: Risk Management Process


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

stage1Category: Strategy Integration


text: Risk management and strategy We have implemented and maintain information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial data ("Information Systems and Data").

companyName: CalciMedica, Inc.

ticker: CALC


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and disaster recovery plan, disaster recovery testing, data encryption for certain data, asset management, system monitoring and multi-factor authentication for certain systems, employee training and cybersecurity insurance.


text: We use a third-party information technology consultant to help identify, assess and manage the Company's cybersecurity threats and risks. This consultant reports to and works with our management team, including our Chief Scientific Officer and President and Chief Operating Officer to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools including for example by subscribing to reports and services that identify cybersecurity threats, leveraging certain system monitoring tools, and leveraging tools provided through Microsoft Office 365.


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our senior management works with our information technology consultant to evaluate material risks from cybersecurity threats against our overall business objectives.


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations, contract manufacturing organizations, and other third-party service providers. We review the cybersecurity risks associated with the use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment and due diligence designed to help identify cybersecurity risks associated with a vendor, as well as the imposition of security related contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems, or those of our CROs or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

stage1Category: None/Other


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Scientific Officer, President and Chief Operating Officer, Vice President Finance and General Counsel who also serves as our compliance officer. These members of management have prior work experience in various roles involving managing information security programs and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents.


text: Our Chief Scientific Officer and our President and Chief Operating Officer are responsible for engaging appropriate personnel and companies, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant employees and personnel. Our President and Chief Operating Officer is also responsible for managing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

stage1Method: majority


text: We have adopted a Cybersecurity Incident Response Policy which is designed to escalate certain cybersecurity incidents to a Cybersecurity Incident Management Team consisting of our Chief Scientific Officer, President and Chief Operating Officer, General Counsel and our information technology consultant. Depending on the circumstances, cybersecurity incidents are reported to our Chief Executive Officer and Chief Financial Officer. Senior management works to help the Company mitigate and remediate cybersecurity incidents of which they are notified in addition to notifying the Audit Committee of the Board of Directors, as appropriate.


text: The Audit Committee of the Board of Directors receives periodic reports as needed from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

stage1Category: Board Governance


text: Strategy and Oversight We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or our information systems and the data contained therein.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: We retain a Chief Information Consultant to collaborate with the company, including the Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us. We also use a third-party security management vendor to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance. As part of our information security program, we provide mandatory periodic training for all employees on how to identify potential cybersecurity risks and protect our resources and information. This training is supplemented by firmwide testing initiatives, including periodic phishing tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Chief Information Consultant works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, our Chief Financial Officer evaluates material risks from cybersecurity threats and, as appropriate, reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled "We depend on our information systems and those of our third-party collaborators, service providers, contractors or consultants. Our information systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our development programs or loss of data or compromise the privacy, security, integrity or confidentiality of sensitive information related to our business and have a material adverse effect on our reputation, business, financial condition or results of operations."


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our Chief Information Consultant.


text: Our Chief Financial Officer is responsible for hiring appropriate consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our Chief Information Consultant, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. The Chief Financial Officer also promptly informs and updates the Board about any information security incidents that may pose significant risk to our Company.


text: The Chief Financial Officer has over 20 years of operations and leadership experience, including experience in information technology strategy and execution. The Chief Information Consultant has over 20 years of experience managing and securing technology infrastructure.


text: We continue to evaluate and improve the capabilities of our people, processes, and technologies to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance, and are reviewed by our Board of Directors annually.

companyName: International Stem Cell CORP

ticker: ISCO


text: Risk Management and Strategy As of December 31, 2023, we have implemented thorough cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are often assessed as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors are required to complete annual cybersecurity awareness trainings, including specific topics related to browser safety, data protection, and email fraud. We have competent employees and consultants with a firm understanding of cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as notify management of such attacks in a timely manner.


text: Our Information Technology General Controls are firmly established based on recognized industry standards and addresses matters such as risk management, data backup, and disaster recovery. We also engage an outsourced information technology consultant to actively monitor and mitigate security threats, as well as identify vulnerabilities and respond to all cybersecurity incidents affecting us, including timely communication of significant security incidents to senior business leadership and our Board of Directors.


text: Our Board of Directors is responsible for overseeing our cyber security risk management and strategy. Our senior leadership, including our Chief Executive Officer and Principal Financial Officer, frequently meets with and provides informative updates to our Board of Directors regarding our cybersecurity risks and activities, including any recent cyber security incidents and related responses, cybersecurity systems testing, and activities of third parties.


text: Our Information Security Team is outsourced to two separate service providers, one of which oversees all aspects of IT and facilities to ensure the Company's infrastructure, including intellectual property, is protected. Specifically, this service provider is tasked with communicating any issues or updates necessary and possesses the appropriate level of expertise to assess and manage the Company's cyber security risk. This service provider reports to our Principal Financial Officer, who oversees prevention, detection, mitigation, and remediation efforts through regular communication and reporting channels within our organization and with service providers.


text: Cybersecurity Threat Disclosure While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. Refer to Part I, Item 1A. Risk Factors for further discussion of cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Omega Therapeutics, Inc.


text: We design and assess our program based on the industry-standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors — Our business and operations may suffer in the event of information technology system failures, deficiencies, or intrusions which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including Chief Financial Officer and Vice President of Data and Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's collective experience includes over ten years of leading cybersecurity oversight and conducting table-top exercises of incident response scenarios.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Key elements of our cybersecurity risk management program include, but are not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.

companyName: Atai Beckley N.V.

ticker: ATAI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Cyberattacks or other failures in our telecommunications or information technology systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our General Counsel, Chief Financial Officer, Head of IT, other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including other internal staff such as the Head of IT and Senior Vice President of Operations, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's and their delegates' collective experience include over ten years of cybersecurity, incident response, and the safeguarding of organizational assets expertise.


text: Our management team stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: DURECT CORP


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • We conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K. Disaster Recovery is tested using various methods such as recovery exercises to simulate a response to a cybersecurity incident, and we use the findings to improve our security, processes, procedures and technologies. • Regular cybersecurity training programs are in place for employees, management and directors. In addition, we conduct annual customer data handling and use requirements training for all employees. • We compare our processes to standards set by the NIST. • Incident handling incorporates the NIST incident handling framework to develop our cybersecurity response procedures and to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident. • We routinely identify and filter out potential threats through threat intelligence processes, attack signatures, and geographic IP filtering. • We closely monitor emerging data protection laws such as GDPR and carefully implement changes to our processes when required for compliance. • We conduct regular phishing email simulations for all employees to enhance awareness and responsiveness to such possible threats. • Through policy, practice and contract (as applicable), we require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care. • We maintain cybersecurity insurance coverage.


text: The committee convenes on a quarterly basis to discuss the current state of cybersecurity affairs, subsequently reporting their findings to the CEO and CFO.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Our process for identifying and assessing material risks from cybersecurity threats incorporates a risk matrix for identifying risk levels for interconnected systems. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: As part of the above approach and processes, we regularly engage with assessors, consultants and other third-parties to review various parts of our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address oversight and identification of cybersecurity threat risks from our use of third-party service providers, including those in our supply chain. This involves, among other things, conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: In the last two fiscal years, we have experienced no material cybersecurity incidents, and the expenses we have incurred from any cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors (our "Board" or "Board of Directors") and management.


text: The audit committee of our Board (the "Audit Committee") is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, Audit Committee members generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Executive Director of IT. Members of the Audit Committee and the full Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Materials of our cybersecurity threat risk management and strategy processes are also periodically reviewed with the full Board.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Executive Director of IT. This individual has over 25 years of prior work experience in various roles involving: managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and developing and implementing IT change control policies and procedures, as well as holds several relevant degrees and certifications, including a master's degree in Computer Information Systems, Certified in Security+, and has completed extensive cybersecurity training and testing in: Certified Professional Hacker (EMC White Hat Training), ISC2 Certified Information Systems Security Professional (CISSP) Training, and NIST Framework Development and Deployment.


text: Our Executive Director of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: As discussed above, our Executive Director of IT reports to our CEO and informs the members of the Audit Committee and the full Board about cybersecurity threat risks, among other cybersecurity related matters. All executives attend cybersecurity training annually.


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT controls, governance, risk and compliance reviews.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Our business is subject to the risks of earthquakes, fire, flood, crop losses, epidemics, and other catastrophic natural events, and security breaches, including cybersecurity incidents." in Item 1A, "Risk Factors" of Part I of this report.


text: Our Audit Committee is responsible for overseeing cybersecurity risks and updates our Board of Directors on cybersecurity matters as needed. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified as promptly as practicable of significant new cybersecurity threats or incidents.


text: Management is responsible for the operational oversight of the company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management The Company has processes for identifying, assessing, and managing material risks from cybersecurity threats. These processes are part of the Company's overall risk management process, as overseen by the Company's Board of Directors, with its audit committee having primary responsibility through its ongoing review of the Company's internal controls and reviewing, at least annually, the Company's information security and technology risks (including cybersecurity). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company, from time-to-time, may engage third-party consultants, advisors, and/or audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate. Additionally, the Company mandates cybersecurity training as part of its company-wide employee onboarding process including best practices to identify potential cybersecurity threats and how to report such threats. The Company also requires regular ongoing cybersecurity training for employees.

companyName: iANTHUS CAPITAL HOLDINGS, INC.

ticker: ITHUF


text: Board of Directors The audit committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, and Vice President of Information Technology. Any updates on cybersecurity matters, including material risks and threats, are provided to the Company's audit committee, and the audit committee provides updates to the Company's Board of Directors at regular Board meetings.


text: Under the oversight of the audit committee of the Company's Board of Directors, and as directed by the Company's Chief Financial Officer, the Vice President of Information Technology is primarily responsible for the assessment and management of material cybersecurity risks, establishing and maintaining adequate and effective internal controls covering cybersecurity matters, and disclosing any material cybersecurity matters faced by the Company. This also includes hiring appropriate personnel and/or third party service providers, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, including the Company's Chief Financial Officer and, as applicable, the Company's Board. The Company's current Vice President of Information Technology has more than 20 years of experience with information technology and related systems security matters and processes.


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1 A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools, processes, and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are integrated into our decision-making processes to monitor and manage risk. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Due to the complexity and evolving nature of cybersecurity threats, we engaged with a cybersecurity assessment firm as an external expert, to evaluate and test our risk management systems. This partnership enables us to leverage specialized knowledge and insights, of dedicated cybersecurity firms. Our collaborations with this third-party include regular system audits, threat assessments, 24-hour monitoring, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct security assessments of all third-party providers before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Senior Director of IT, who oversees the Company's cybersecurity function.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. Although we have not experienced cybersecurity incidents, a significant cybersecurity incidence could reasonably have a material adverse effect as against us, such as malware or ransomware attacks or DoS attacks, which could lead to business disruptions, unplanned downtimes or outages, particularly in critical systems or services, may impact our ability to operate efficiently, affecting business continuity.


text: We have implemented standard operating procedures to define the channels by which cybersecurity threats are communicated to the Board. This ensures that Board has oversight and effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, which we believe equips them to oversee cybersecurity and other risks effectively.


text: Management's Role Managing Risk The Senior Director of IT plays a pivotal role in informing the Audit Committee on cybersecurity risks. This role provides briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Senior Director of IT and department staff. Our IT team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Senior Director of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Under his direction, the IT department implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the IT department is equipped with a well-defined written procedure. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Senior Director of IT consistently communicates with the Audit Committee regarding critical cybersecurity risks and incidents, ensuring that the organization's highest governance bodies remain well-informed about our cybersecurity status and potential vulnerabilities. Moreover, matters of significant cybersecurity importance, along with strategic risk management decisions, are promptly escalated to the Board of Directors. This process ensures that the Board maintains thorough oversight and is equipped to offer informed guidance on critical cybersecurity issues.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. As such, the Company relies on the Adviser's risk management program and process, which include cyber risk assessments, as well as other third-party service providers to protect the Company's information from cybersecurity threats.

companyName: First Eagle Private Credit Fund


text: Cybersecurity Risk Management and Strategy The Adviser has implemented policies and associated controls and procedures to safeguard both firm and client data and assets (the "Cybersecurity Program"), and the Cybersecurity Program continues to evolve in an effort to keep pace with industry best practices and ever-changing cyber threat environment. The Cybersecurity Program is designed to protect the confidentiality, integrity, and availability of client and consumer information systems, and the Adviser's proprietary information in compliance with SEC Guidance 2015-02 regarding Cybersecurity, and FINRA's guidance regarding Customer Information Protection, and interagency guidance on safeguarding information. Periodic updates on the Cybersecurity Program are provided to the Adviser's Head of Risk, along with the Adviser's Risk Committee, and the Board.


text: The Cybersecurity Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as amended. These NIST functions are used as high-level categories to organize and report on the status of the Cybersecurity Program and are tailored to the Adviser's business objectives. There are areas within the NIST framework that the Adviser might not find applicable to its business and not necessary to fulfill the objectives of the Cybersecurity Program. The Adviser utilizes an aggregated approach to cybersecurity and considers the acceptance, avoidance, transfer, and mitigation of risks in attaining long term business objectives and minimizing financial loss. In terms of security incident and event management, the Adviser implements multiple technologies (including, but not limited to, enterprise grade next generation firewalls, well-known anti-malware protection, application whitelisting, and end detection and response software) in different layers of the Adviser's network, including utilizing a third-party vendor that provides monitoring of the Adviser's systems on a 24 hour/day, seven days/week basis. In addition, the Adviser has developed customized firm-wide cybersecurity training sessions for employees with the assistance of an outside vendor. Cybersecurity training is provided to all new employees upon hire and annually for all employees. In addition, the Adviser conducts phishing training on a monthly basis and sends out periodic newsletters on pertinent cybersecurity-related topics and events. In 2022, the Adviser engaged a consultant to conduct an independent cybersecurity risk assessment, and the Adviser has since then implemented all priority recommendations from this engagement. Other non-priority recommendations have been considered for implementation over time.


text: Cybersecurity Governance Management's Role in Cybersecurity Risk Management The Company's chief compliance officer (the "CCO"), in partnership with the Adviser's Chief Information Security Officer (the "CISO"), oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company.


text: Additionally, as part of the Adviser's vendor management program, members of the Adviser's information security teams will conduct periodic due diligence on the cybersecurity/data security programs of the Company's third-party service providers (this review is conducted annually with respect to the Company's custodian, sub-administrator and transfer agent). As part of their oversight of third-party service providers to the Company, the Company's CCO and the Adviser's CISO review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters and evaluate the service providers' use of information systems which may give rise to information technology vulnerabilities. Potential cybersecurity risks are identified and implications of such risks, if any, to the Company are assessed and monitored. In addition, the CCO receives regular reports from the third-party service providers regarding any cybersecurity threats and incidents at such service provider.


text: The Adviser's CISO has over 9 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. The responsibility of the CISO is to maintain confidentiality, availability, and integrity of the Adviser's data and that of its clients and shareholders. The CISO also reports to the Adviser's Enterprise Operations Committee on a semiannual basis. The committee is charged with determining the security posture of the Adviser. It is responsible for accepting, deferring, or mitigating the risks presented by the CISO. The CISO is also responsible for maintaining all policies and controls pertaining to cybersecurity and conducting annual risk assessments. The Company's CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. The CCO reports to the general counsel of the Sub-Adviser and Administrator of the Company and to the Board on all compliance risk related matters, including those related to cybersecurity.


text: The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO and CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company. Additionally, the CCO provides updates to the Board on any reported incidences of the Company's service providers. The CCO informs the Board of material cybersecurity matters as they arise.


text: Assessment of Cybersecurity Risk The Company assesses the potential impact of risks from cybersecurity threats on an ongoing basis, and how such risks could materially affect the Company's investment strategy, operations and financial condition. As of the date of this Annual Report, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company. However, future incidents could have a material impact on our business strategy, results of investment activities and operations, or financial condition. For additional information about these risks, see "Item 1A. Risk Factors".


text: Protecting our technology platform and the data that our guests and hosts share with us is critical to our business. We maintain a process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management processes. We employ privacy, safety, and security professionals to oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with cybersecurity expertise across multiple industries, including our CTO, VP of Engineering, and head of information technology. Our executive leadership team, along with input from these teams, is responsible for our overall enterprise risk management processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Getaround, Inc


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our contracted IT Director, who has over 24 years of IT management experience for public companies including Synergy Pharmaceuticals, Inc.

companyName: Turnstone Biologics Corp.


text: As part of our cybersecurity risk management system, our incident management process tracks and logs privacy and security incidents across our business to remediate and resolve any such incidents. Significant incidents are reviewed regularly by our CTO, VP of Engineering, and head of IT to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment to the broader executive leadership team. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent registered public accounting firm of matters and any relevant developments.


text: The Board has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board.


text: Our business strategy, results of operations and financial condition have not been materially affected by cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see the section entitled "Risk Factors" in this report.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. As an externally managed company, our business is highly dependent on the communications and information systems of our Advisor, its affiliates and third-party service providers. Our Advisor is an indirect subsidiary of Cantor, a diversified organization specializing in financial services and real estate for institutional customers operating in the global financial and commercial real estate markets. Cantor has a global cybersecurity process applicable to all subsidiaries and business lines, including our business.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: Risk Management and Strategy Cantor's global cybersecurity processes form the comprehensive framework for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. Cantor aims to conduct its cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by Cantor's cybersecurity team and supported by its business continuity teams.


text: Cantor conducts periodic internal and external vulnerability audits and assessments and penetration testing and provides periodic cybersecurity training to employees. These measures include regular phishing simulations, annual general cybersecurity awareness training and data protection training. Cantor participates in industry-specific cybersecurity roundtables and professional groups to ensure it remains abreast of industry-wide cybersecurity developments and best practices and thereby enhances our threat identification processes and responses as necessary. Additionally, when engaging with and utilizing third-party vendors and partners for its business, Cantor conducts various oversight assessments, including due diligence and periodic monitoring to identify potential cybersecurity threats associated with conducting business with such vendors and partners and to ensure any corresponding risk exposure aligns with Cantor's business requirements and risk tolerances.


text: Cantor maintains an incident reporting and escalation process in the event of any observed, detected, or suspected events that it believes may qualify as a cybersecurity incident. Risks are identified based on a four-tier system, and tiers are assigned based on the service impact, user impact, financial impact, and security impact that a threat may pose. Cantor's processes include steps to recover our systems and information through established and tested system recovery plans and business continuity plans, each based on the appropriate response associated with the corresponding tier of the identified threat. Cantor's incident response process includes steps to notify key incident management team members who are responsible for communicating with regulatory and other governmental authorities about cybersecurity events as applicable and as required by law. Cantor determines the materiality of such incidents based upon a number of factors including if the incident had or may have a material impact on the respective business strategy, results of operations, or financial condition. This process involves a review of the nature of the incident by Cantor's cybersecurity team as well as other members of management and employees with specialized technological or financial knowledge, as applicable. In the event of a material breach, Cantor has a process for escalation to appropriate members of its senior management, who would, if appropriate, communicate with our management and board of directors or audit committee. These groups would also collaborate in determining the appropriate response to such events and disclosure of any material breach.


text: Cantor engages third parties from time to time that assist it in the identification, assessment, and management of cybersecurity risks. Cantor also engages cybersecurity specialists to complete assessments of its cybersecurity processes, program and practices, including data protection practices, as well as to conduct targeted attack simulations. The feedback from these assessments and guidance from external specialists informs Cantor's overall risk management system and the development and improvement of our processes to mitigate cybersecurity risks throughout the Company.


text: Governance and Management Our board of directors has responsibility for the direction and oversight of our risk management, which would include cybersecurity risk management. Our board of directors administers this oversight function directly, with support from its audit committee (the "audit committee"). In particular, the audit committee considers and discusses our major risk exposures and the steps our Advisor takes, or is required to take, to monitor and control these exposures. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function.


text: The audit committee will engage in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, which will include those that result from material cybersecurity threats as necessary.


text: As an externally managed company, we rely on Cantor's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by Cantor.


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. For more information about the cybersecurity risks we face, see the risk factor entitled "Malicious cyber-attacks and other adverse events affecting the Company's operational systems or infrastructure, or those of third parties, could disrupt the Company's business, result in the disclosure of confidential information, damage the Company's reputation and cause losses or regulatory penalties" in Item 1A- Risk Factors.


text: Our Board of Directors recognizes the critical importance of information security to the Company's operational success. We continue to make substantial investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks are integrated into our overall risk management governance and are reviewed on at least a quarterly basis by the Audit Committee of our Board of Directors and at least annually by the full Board of Directors. The policies, processes and standards designed to mitigate those risks are based on recognized frameworks established by the National Institute of Standards and Technology, and are focused on preserving the confidentiality, security, and availability of information that the Company collects and stores. The Company takes a comprehensive approach to analyzing and mitigating cybersecurity risks, focused on preventing, identifying, mitigating, and responding to cybersecurity threats.

companyName: Telesis Bio Inc.


text: Policies and Procedures As of December 31, 2023, we have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our comprehensive information security program is based on recognized industry standards covering areas such as risk management, incident response, change management, vendor assessment, data backup, and disaster recovery. Our policies and procedures provide for the prompt escalation and communication of significant cybersecurity incidents so that Company senior management, and where appropriate, the Board of Directors, can make decisions regarding the handling, public disclosure and reporting of such incidents in a timely and effective manner.


text: Technical Safeguards We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks. These safeguards include firewalls, intrusion prevention, testing and detection tools, anti-malware functionality, software patch management, facility and infrastructure security, system change control, and access controls. Technical safeguards are evaluated and upgraded over time to address risks identified through vulnerability assessments and cybersecurity threat analysis. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us.


text: Testing and Assessments We conduct periodic reviews and tests of Company policies, processes, and standards designed to address cybersecurity risks and incidents. These efforts include annual vulnerability and penetration testing, audits, and other measures to identify and remediate cybersecurity gaps. The Company engages third parties to perform audits and assessments on our information security control environment and operational effectiveness, including information security maturity assessments. The results of such reviews, audits, and assessments are reported to the Audit Committee and senior management, and the Company makes adjustments to its cybersecurity policies, standards and processes as necessary based on this information. The Company also retains consultants and other advisors to assist in the development and maintenance of cybersecurity and data protection policies and procedures in compliance with applicable regulations and standards.


text: Incident Response and Recovery Planning The Company has implemented and maintains detailed incident response and backup and recovery plans designed to fully address the Company's response to a cybersecurity incident. These plans are tested and assessed on a periodic basis.


text: 2. Employee Awareness and Training: PyraMax Bank recognizes that employees are a critical line of defense against cyber threats. Therefore, the Bank invests in comprehensive cybersecurity awareness training programs to educate employees about potential risks and best practices for safeguarding sensitive information.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: Third Party Risk Management The Company has implemented a vendor management procedure to identify, evaluate, and oversee cybersecurity risks posed by third parties, including vendors, service providers and external users of the Company's information systems, as well as third party systems that collect, store or otherwise interact with Company information. The Company conducts vendor assessments to review third party security measures, as well as adherence to relevant industry information security standards.


text: Education and Awareness Our employees and contractors receive regular cybersecurity awareness training, including specific topics related to social engineering and email fraud, to communicate the Company's evolving information security policies, procedures, and standards. Employee training includes periodic phishing exercises to provide Company employees with a heightened level of awareness to cybersecurity threats, and to equip them with relevant information to prevent cybersecurity incidents.


text: Our Board of Directors' Audit Committee is responsible for overseeing our cybersecurity risk management and strategy. The Company's Director of IT Operations reports to the Audit Committee and other members of management on at least a quarterly basis on cybersecurity risks. These reports provide a comprehensive view of the Company's cybersecurity program, including recent developments, cybersecurity strategy, ongoing assessments of the Company's security posture and cyber threats and risks, results of third party audits and testing, policy and procedure updates, security upgrades and initiatives, risk mitigation strategies, and employee training programs. Under the Company's cybersecurity Incident Response Plan, the Audit Committee and executive management also receive prompt information regarding any incidents that may meet established reporting thresholds, as well as ongoing updates regarding any such incident until it has been fully resolved.


text: The Company's Director of IT Operations works collaboratively with the Chief Executive Officer (CEO), Chief Financial Officer, (CFO) and Chief Legal Officer (CLO) to implement a thorough program to assess cybersecurity risks and vulnerabilities, protect the Company's information systems from cybersecurity threats, and respond effectively to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through this program, the Company monitors the prevention, detection, mitigation and remediation of cybersecurity threats in real time, reporting to the Audit Committee when appropriate.


text: The Director of IT Operations has served in various roles in information technology and security across multiple industries for over 35 years. In addition, the Company retains qualified employees and engages consultants with significant expertise and certifications in cybersecurity relevant to our industry. The Company's CEO, CFO, and CLO each hold degrees relevant to their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Threat Disclosure We are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business, results of operations, or financial condition. In the event of a future cybersecurity incident, the Company has procedures in place to identify whether the incident or associated cybersecurity risks have materially affected or are reasonably likely to materially affect the Company, to ensure that disclosures are made where required under applicable law or regulation. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Senior Technology/Cybersecurity Officer is primarily responsible for this cybersecurity component and is a key member of the Company's Information Technology Governance, along with our Chief Finance/Information Security Officer, including the Enterprise Risk Management Committee ("ERM"), the Information Technology Steering Committee ("ITSC") and the Information Technology Advisory Committee ("ITAC"), reporting directly to the Chief Information Officer. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 30 years of cybersecurity experience, 5 of which was spent at the Company. The ITAC and ERM are board level committees with the ITSC consisting of members of management.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Finance/Information Security Officer and our Chief Information Officer, report directly to our Chief Executive Officer, and along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: 3. Vendor Risk Management: PyraMax Bank evaluates and manages the cybersecurity risks associated with third-party vendors. Vendor contracts include provisions for security requirements, regular assessments, and compliance with industry standards.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "secure by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a portion of our workforce has the option to work remotely. We leverage internal auditors to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below. The IRP is coordinated through the Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and key members of management are embedded into the IRP by its design. The IRP facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company.


text: Our Chief Finance/Information Security Officer has oversight of information security across the organization, with the Senior Technology/Cybersecurity Officer independently accountable for managing our enterprise information security department and delivering our information security program. The responsibility of this role includes cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first and second line of defense functions. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Information Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the ITAC, which focuses on technology impact, and ERM, which focuses on business impact while the ITSC is an internal management committee providing direction and priorities to information technology strategies. These committees provide oversight and governance of the technology program and the information security program. The ITAC and ERM are chaired by certain members of the board of directors with senior management participation including the Chief Finance/Information Security Officer, Chief Information Officer, Senior Technology/Cybersecurity Officer as well as other key departmental managers from throughout the organization. These committees meet periodically to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Senior Technology/Cybersecurity Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the ITAC on a quarterly basis (or more frequently as may be required by the IRP).


text: The ITAC is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and our Chief Information Officer provide quarterly reports to the ITAC and ERM regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The ITAC reviews and approves our information security and technology budgets and strategies annually. Additionally, the ERM reviews our cyber security risk profile on a quarterly basis. The ITAC and ERM provide a report of their activities to the board of directors regularly.


text: The Board of Directors receives periodic training related to cybersecurity and annually reviews comprehensive risk assessments of the Company's information technology, privacy and cybersecurity programs. The Board of Directors formally approves the Company's cybersecurity policies and program annually, and more frequently if material changes are adopted. Oversight of the Company's Information Security Program has been delegated to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee receives quarterly reports on the effectiveness and overall performance of the cybersecurity program and provides a report of the same to the full Board of Directors.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. The Company takes very seriously the responsibilities to protect sensitive client information, technology resources, and shareholder value from the risk of cyber threats and incidents. The Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition or results of operation. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.


text: Cybersecurity Risk Management and Strategy The Company maintains an enterprise-wide and Board-approved Information Security Program (the "Program"), which includes policies, procedures, guidelines and standards to address the assessment, identification and management of cybersecurity risks. The Company designed the Program to be consistent with industry standards that include National Institute of Standards and Technology ("NIST") Cybersecurity Framework, the Financial Services Sector Cybersecurity Risk ("CRI") Profile, and the Federal Financial Institutions Examination Council Cyber Security Assessment. Core activities supporting the Company's strategy include leveraging people, technology and processes to manage and maintain cybersecurity controls.


text: People play a significant role in our defense against cybersecurity threats. We have established policies, training, and client education to mitigate cyber risk.


text: Additionally, we employ innovative technology solutions designed to identify, protect, detect, and mitigate cybersecurity threats through use of firewalls, intrusion detection systems, patching, endpoint detection and response, encryption, multi factor authentication, and data backups to immutable storage.


text: We regularly engage third-party assessors, auditors, and solutions to test and evaluate our controls for managing cybersecurity threats. These engagements include penetration testing, vulnerability assessments, internal and external audits, security framework maturity assessments for continued focus and improvement, and social engineering tests of the effectiveness of our employee training to monitor our security posture. We leverage a managed service provider to monitor users, application, infrastructure, and network activity on a 24/7/365 basis to detect and alert the cyber security operation team of cyber threats and potential cybersecurity events of concern.


text: The Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. We exercise a detailed vendor due diligence evaluation during the onboarding, and periodic reviews of these vendors with access to sensitive Company data. The Company requires contracts of third parties to incorporate industry and regulatory standard clauses requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.


text: In the event of a cyber incident, the Company created and maintains a Business Contingency Program. This program provides guidance that will be needed to prepare, detect, analyze, remediate and recover business operations quickly and with the least impact to the Company and its customers.


text: Cybersecurity Governance The Company has established an Information Security Committee consisting of the Chief Operations & Technology Officer, Chief Risk Officer, Information Security Officer and department representatives across multiple functional areas of the Company to focus on cybersecurity strategic and tactical delivery, policy oversight, monitoring of key cybersecurity risk indicators, and the assessment and management of cyber risk threats. The Committee is assisted by a Virtual Chief Information Security Officer (the "vCISO") which is provided by a contracted third-party security firm. The Committee's activities support the overall protection of data and information assets of the Company in accordance with the Information Security Program, regulatory privacy requirements and Federal Financial Institutions Examination Council guidance. The Committee submits a quarterly report, together with the minutes of its meetings, to the Enterprise Risk Management Committee of the Board of Directors.


text: The Chief Operations & Technology Officer, among other duties, is responsible for the security and integrity of infrastructure, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the vCISO and our risk management department. Our Chief Operations & Technology Officer has over 25 years of relevant experience in information technology and information security, building and leading technical organizations of various sizes, including in the banking industry. The vCISO has served in various roles in information technology and information security for 20 years, and holds multiple certifications relevant to cybersecurity, including CMMC (Cybersecurity Maturity Model Certification) and Fortinet NSE (Network Security Expert) level 3.


text: The Company engages external independent parties to perform independent audit engagements, as well as other assessments of the Company's information security and third-party risk management program and information systems. Material findings and recommendations arising from these assessments are reported to the Audit Committee of the Board of Directors.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the Investment Company Act, our day-to-day operations are managed by the Investment Adviser, Administrator and our executive officers under the oversight of our Board of Directors. Our executive officers are senior professionals of the Investment Adviser. We obtain our cybersecurity program-related services as part of a larger set of services provided to the parent company of our Investment Adviser by JFG under written agreement. As such, we rely on JFG's information systems infrastructure and JFG's processes for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details JFG has provided to us regarding its cybersecurity program.

companyName: Senior Credit Investments, LLC


text: JFG's Chief Information Security Officer ("CISO") and his Global Information Security team ("GIS") oversee JFG's cybersecurity program and exercise overall responsibility for the strategic vision and the design, development, and implementation of, and adherence to, the program's protocols. The comprehensive program includes policies and procedures designed to protect JFG systems, operations, and the data entrusted to it, including by us, from anticipated threats or hazards. The program applies seven layers of controls: governance, identification, protection, detection, response, recovery, and third-party vendor management. Protective measures include, where appropriate, physical and digital access controls, software security and patch management, identity verification, mobile device management, data loss prevention solutions, employee cybersecurity awareness communications and best practices training programs, security baselines and tools to detect and report anomalous activity, service provider risk assessments, network monitoring of data usage, hardware and software, and data erasure and media disposal, among others. Measures, policies and standards are aligned with industry-leading frameworks, such as those promulgated by the International Organization for Standardization and the National Institute of Standards and Technology ("NIST").


text: JFG tests its cybersecurity defenses regularly through automated vulnerability scanning by GIS's 24/7 Security Operations Group to identify and remediate critical vulnerabilities. In addition, an independent vendor conducts annual "white hat" penetration tests to validate its external security posture. For certain JFG businesses, JFG also conducts cyber incident tabletop exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by JFG's IT Risk team in collaboration with outside service providers as appropriate and members of JFG's senior management and Legal and Compliance teams. Learnings from these tabletop exercises and any events that JFG experiences are reviewed, discussed, and incorporated into its cybersecurity risk management processes as appropriate. In addition to JFG's internal exercises to test aspects of its cybersecurity program, JFG annually engages an independent third party to assess the risks associated with its information systems and information assets and the JFG risk management program. The independent third party assesses the cybersecurity program against the Cyber Risk Institute Cyber Profile, a financial sector-focused framework based on the NIST Cybersecurity Framework, the results of which are reported to the JFG Board of Directors (the "JFG Board") and inform JFG's program.


text: JFG has a comprehensive cybersecurity incident response and communication plan (the "IRP"), managed by the Security Operations Group, which is designed to inform appropriate risk management and business managers (including, as appropriate, our executive officers and other representatives of the Investment Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate such an event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and law enforcement agencies. The IRP is reviewed at least annually.


text: JFG maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. This process includes reviewing risks discerned from time to time from both internal events and from external events, alerts and reports received from a broad variety of sources. Reports from external sources are also reviewed to formulate risk mitigation and remediation strategies. JFG's CISO periodically discusses and reviews cybersecurity risks and related mitigants with JFG's Chief Information Officer ("CIO"), the Head of IT Risk, and General Counsel and incorporates relevant cybersecurity risk updates and metrics. JFG adjusts and enhances its cybersecurity program in response to the evolving cybersecurity landscape and to align with regulatory and industry standards.


text: JFG employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors and service providers. This assessment is conducted on the basis of, among other factors, the types of products or services provided and the extent and type of data accessed or processed by the third party.


text: Cybersecurity is assessed by IT Risk and approved by the CIO as a component of JFG's annual, enterprise-wide Risk Control Self Assessment ("RCSA") managed by JFG's Operational Risk Group. The RCSA process is independently verified by JFG's Internal Audit Department.


text: JFG's CISO has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across JFG's global businesses. He has over twenty years' experience managing cybersecurity in the financial and consulting services industries.

companyName: Jefferies Credit Partners BDC Inc.


text: Although since inception, we have not experienced a material information security breach incident, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the JFG and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors - Risk Related to our Business - Cybersecurity risks and cyber incidents may adversely affect our business or the business of our Portfolio Companies by causing a disruption to our operations or the operations of our Portfolio Companies, a compromise or corruption of our confidential information or the confidential information of our Portfolio Companies and/or damage to our business relationships or the business relationships of our Portfolio Companies, all of which could negatively impact the business, financial condition and operating results of us or our Portfolio Companies" in this annual report.


text: Cybersecurity Governance JFG has a dedicated GIS team, led by its CISO, who reports to JFG's CIO. The CISO works closely with JFG's CIO, Chief Financial Officer, and the Chief Risk Officer's ("CRO") team and Legal and Compliance Departments, to develop and advance the firm's cybersecurity strategy, which applies to us.


text: JFG conducts periodic cybersecurity risk assessments, including assessments of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CISO reviews the cybersecurity framework annually as well as on an event-driven basis as necessary, and reviews the scope of cybersecurity measures periodically, including to accommodate changes in business practices that may implicate security-related issues.


text: JFG's cybersecurity program is periodically assessed by JFG's Internal Audit Department. The results of these audits are reported to the Audit Committee of the JFG Board. Any resulting findings and associated actions to address issues are tracked and managed to completion. In addition, JFG's IT Risk team provides Key Risk Indicators ("KRIs") monthly to JFG's Operational Risk Committee whose members include the CIO, CRO, Head of Internal Audit and the CISO and their representatives. The monthly presentation includes updates on key security incidents and trending of cybersecurity KRIs.


text: The JFG Board is responsible for the general oversight of all matters that affect JFG, including the myriad risks impacting it. The JFG Board fulfills its oversight role through the operations of its various committees and receives periodic reports on its committees' activities.


text: The JFG Board's Risk and Liquidity Oversight Committee oversees JFG's enterprise risk management. Oversight includes reviewing and approving annually JFG's risk management framework and overarching risk appetite statements; reviewing JFG's technology, cybersecurity and privacy risk, legal and regulatory risk, and reputational risk,among other JFG major risk exposures; reviewing the steps management has taken to monitor and control such exposures; and reviewing JFG's capital, liquidity and funding against established risk methodologies. The CISO keeps the JFG Board informed about JFG's security posture and cybersecurity maturity program on a regular basis, providing updates about cybersecurity events, significant incidents, and new initiatives.


text: Our Board of Directors is responsible for understanding the primary risks to our business, including any cybersecurity risks. Our Board of Directors may receive periodic updates from our Chief Compliance Officer, our General Counsel, our Chief Operating Officer or from our Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting our business.


text: The audit committee receives periodic reports from Mr. Gharib concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.


text: The Information Technology ("IT") Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (the "CIO") who reports directly to the Company's Chief Operating Officer and Chief Financial Officer. The CIO has more than 37 years of relevant experience both with the Company and with other organizations in the IT field. The CIO also oversees the Company's Information Security Program and manages a third-party consultant that is an expert in the Information Security field and acts as our Information Security Officer ("ISO"). The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The IT Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology and Information Security Committee ("IT/IS Committee"), and presents information security and cybersecurity updates on a monthly basis to the IT/IS Committee and periodically to the Board of Directors.