text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers. We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations and contract manufacturing organizations. We manage cybersecurity risks associated with our use of these providers by reviewing their conducting audits and imposing contractual obligations on the vendor to protect our information.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA

secItem: Item 1C

stage1Category: Third-Party Risk

stage1Method: majority


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

stage1Category: None/Other

stage1Method: unanimous


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Chief Financial Officer, who oversees outsourced IT (including cybersecurity).

stage1Category: Management Role


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the Chief Financial Officer. Our Chief Financial Officer and others work with our incident response team (including our MSSP) to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting certain cyber incidents to the audit committee.

stage1Category: Risk Management Process


text: The audit committee receives periodic reports from our cybersecurity function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats. We have an enterprise-wide cybersecurity risk management program to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: Manitex International, Inc.


text: Our cybersecurity risk management program leverages the Center for Internet Security (CIS) framework. This includes the CIS Risk Assessment Method (CIS RAM) and CIS Controls Self-Assessment (CSAT). We are implementing CIS Critical Security Controls to assess and strengthen our risk management and cybersecurity posture against an evolving threat landscape.


text: Key elements of our cybersecurity risk management program include: • The formalization and implementation of enterprise-wide IT and Information Security Policies which include encryption standards, antivirus protection, vulnerability management and reporting, multifactor authentication, granting and removing of access, confidential information, credential standards, and the baseline hardening of devices; • Conducting vulnerability assessments and penetration tests; • Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system; • Revision of user access request documentation to clearly define the roles and permissions assigned to users; • Thorough review of the accuracy and completeness of user listings and access; • Monthly evaluations to identify and assess cybersecurity risk to our enterprise information technology environment; • Continued collaboration with external specialists to aid in the ongoing evaluation of existing policies and assess, test or otherwise assist with aspects of our security controls; and • General cybersecurity training for all employees and role-based specialized training for certain roles to enhance the awareness of shared responsibility for cybersecurity risk management.


text: We continue to face multiple cybersecurity risks, and, in the past, we have had minor incidents. None of the prior incidents had a material effect on our reputation, business strategy, results of operations or financial condition. For more information on the cybersecurity threats and risks we face, see Part I, Item 1A. – Risk Factors.

stage1Category: Strategy Integration


text: Cybersecurity Governance The Board of Directors has delegated the oversight of cybersecurity risk to the Audit Committee. The Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our CFO, regularly briefs the Audit Committee on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.

stage1Category: Board Governance


text: Through our IT Steering Committee, the Director of Global IT provides regular reports to the CFO on cybersecurity metrics and any cybersecurity incidents. The Company's Director of Global IT is responsible for developing and implementing the information security program and reporting on cybersecurity matters to the CFO and the IT Steering Committee. Our IT Steering Committee is comprised of representatives from Information Security and Technology, Internal Audit and members of executive management. This committee meets periodically to discuss and review Manitex's information security program and receives updates from the Information Security and Technology Department and Internal Audit Department.


text: We have continued to expand our security controls, investment, and oversight of our cybersecurity program. The Information Security and Technology management team regularly monitors alerts and reviews the resolutions. We regularly test and review our defenses by performing internal tests, including phishing and vishing tests, external red team penetration testing, and by reviewing our operational policies, procedures, and controls with third-party experts. Prior to engaging a third-party vendor, IT management reviews and approves service organizational control reports. The review of vendor SOC reports for existing vendors is completed annually. Tests, reviews, and assessments are important tools for properly maintaining a robust cybersecurity program.


text: Cybersecurity Risk Management We assess, identify and manage material risks from cybersecurity threats through various policies, procedures and processes, including through our Enterprise Risk Management program (ERM), our information security policies and standards, workforce cybersecurity trainings and third-party assessments and programs.

companyName: STEPAN CO

ticker: SCL


text: o our Chief Privacy Officer; and o our crisis management team, a cross-functional team of senior management and subject matter experts from across the Company established to be ready to respond to crisis events, including those arising from cybersecurity incidents.

companyName: EASTMAN KODAK CO

ticker: KODK


text: The Company uses ERM principles to help identify, prevent, and mitigate potential risks, including cybersecurity and related risks. We base our ERM program on the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. Individuals representing Stepan's global locations and functions contribute to our risk assessments at least annually through surveys and in-person interviews. Members are polled quarterly to spot emerging risks and trends. The Company's Vice President, Chief Compliance and Risk Officer leads the ERM program and reports regularly to the Audit Committee of the Board of Directors on ERM matters.


text: The Company maintains cybersecurity programs according to the set of guidelines developed by the National Institute of Standards and Technology through the Cybersecurity Framework. The Company maintains a set of IT Security Standards that provides a framework of layered security protection. In addition, the Company maintains and communicates to its workforce a Use of Information Technology Policy to support the understanding of and commitment to safely using IT assets. This knowledge can help prevent accidental or intentional misuse of Company IT resources, which can compromise the confidentiality, integrity, and availability of sensitive data and systems. The Company requires cybersecurity training to raise awareness and educate employees about cybersecurity risks. The Company updates its training program at least annually.


text: The Company engages a variety of IT assessors to evaluate and test the Company's cybersecurity and cybersecurity controls. Additionally, the Company engages IT consultants to provide tabletop exercises, ransomware simulations, cyber policy and standards development, cybersecurity, data security, and IT training events, cybersecurity and data security testing and monitoring, and cybersecurity implementation projects.


text: Although the Company has put in place the cybersecurity policies, procedures and processes described above, the Company remains exposed to cybersecurity attacks and incidents and misuse or manipulation of any of its IT systems, which could have a material adverse effect on its business strategy, results of operations or financial condition. As of the filing of this Form 10-K, we are not aware of any attacks, incidents, misuse or manipulation that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. For risks associated with cybersecurity threats, see the risk factor "The Company relies extensively on information technology (IT) systems to conduct its business. Interruption of, damage to or compromise of the Company's IT systems and failure to maintain the integrity of customer, colleague or Company data could harm the Company's reputation and have an adverse effect on the Company's business, financial position, results of operations and cash flows." included in "Part I—Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Cybersecurity Governance The Audit Committee of the Company's Board of Directors (the Audit Committee) oversees the Company's cybersecurity risk management. The Audit Committee receives quarterly reports on cybersecurity risks and risk management from the Company's Vice President of Information Technology. The Company's Vice President of Information Technology, who reports to the Vice President and Chief Financial Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees. Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company's Vice President of Information Technology has served in a variety of IT and cybersecurity roles for twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company's Cybersecurity Manager, who reports to the Vice President of Information Technology, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience. The Company's cybersecurity program and cybersecurity practices are reviewed by internal and external auditors. The Company's cybersecurity team provides periodic reports to such auditors.


text: Risk Management and Strategy The Company maintains a cyber risk management program to prevent, detect and respond to information security threats. This program is supervised by a dedicated Chief Information Security Officer (CISO) whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The CISO manages the program in collaboration with the Company's businesses and functions. To mitigate the risk of cybersecurity threats and data breaches we also have established policies and procedures, including a Cybersecurity & Data Breach Incident Response Policy and identified an Incident Response Team (IRT) with defined roles, responsibilities and means of communication. As part of our broader risk management and control framework we have implemented cybersecurity controls over the information technology and process control systems of the Company and of its third-party service providers. The Company engages third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer and vendor data as well as data affecting our process controls and data used to operate our manufacturing and converting facilities. We work with an independent assessor to conduct interim assessments and track ongoing efforts to continuously improve the Company's cyber risk management program. The most recent assessment was completed at the end of 2022. In addition, the Company utilizes an independent audit firm to perform specific attack and penetration reviews on an annual basis. While we have experienced threats to our data and systems, as of December 31, 2023, we are not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or financial condition.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: Board Roles and Responsibilities The Audit Committee of the Board of Directors oversees the Company's cyber risk management program. The Chief Information Officer (CIO) and the Vice President of Network Services present frequent updates to the Audit Committee and, as necessary, to the full Board of Directors. These regular reports include detailed updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. In addition, we have established processes to notify the Audit Committee of active incidents, as deemed necessary. The Company's program is periodically evaluated by third-party experts, and the results of those reviews are reported to the Board of Directors.


text: We are continuously focused on ensuring our Company is protected from potential cyber threats. Our Information Technology (IT) team is comprised of employees with a diverse mix of skills, backgrounds, perspectives, and relevant expertise, that undergo extensive training as part of their employment with the Company. We believe these measures together with our cyber risk management program as well as our policies, processes and procedures set a high benchmark for our employees to address and respond to cybersecurity threats.


text: Our IT team regularly monitors best practices and as needed, implements changes to the Company's cyber risk management program to ensure a robust program is maintained. Aspects of this program include plans and procedures for identifying, communicating and containing security incidents, regular risk assessments and testing of the Company's internal infrastructure to identify vulnerabilities, procedures for recovering from disruptions to our operations, maintaining global security policies, and comprehensive end user training and cybersecurity drills for personnel.


text: The Company maintains a cybersecurity risk management program, led by a Chief Information Security Officer (CISO), that is responsible for the Company's overall cybersecurity strategy, policy, architecture, and cyber threat detection and response. The CISO, who reports to the Company's Chief Information Officer (CIO), has a Bachelor degree in Information Systems and MBA and is a Certified Information Systems Security Professional with over a decade of professional cybersecurity experience. The program aligned industry frameworks and controls from the National Institute of Standards and Technology. Leveraging these frameworks and controls allows the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain cybersecurity, including threat intelligence, multi-factor authentication, endpoint detection and response, and security automation.

companyName: OSHKOSH CORP

ticker: OSK


text: As part of the cybersecurity risk management program, the Company has a set of Company-wide cybersecurity policies and procedures, including an Acceptable Use Policy as well as other policies covering subjects such as Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Media Protection, System and Communications Protection, and Incident Response. These policies and procedures go through an internal review process and are approved by appropriate members of management. The Company requires all personnel, including contingent workers and business partners handling information on the Company's behalf to follow its cybersecurity policies and procedures. Regular training modules educate the Company's team members on relevant cyber threats and trends and help prepare them for real-life phishing threats.


text: The Company implements processes to assess and manage risks associated with using third-party information system service providers. This risk assessment process assesses both the service provider's security posture as well as the security controls available from the third-party information system. The service provider's security posture assessment includes reviewing any third-party party attestations as well as third-party controls in the following areas: assets, data flows, authentication, access, monitoring, response, and recovery. Depending on the type of system or data, additional controls may be assessed.


text: The Incident Response Plan includes processes for detecting, containing, and responding to incidents including processes for reporting incidents to management and the Board of Directors. The Company periodically performs simulations and tabletop exercises at a management level and incorporates external advisors as needed. The Company engages third-party services to conduct evaluations of its security controls, whether through penetration testing, independent audits or consulting on best practices to address cybersecurity risks.


text: Assessing, identifying and managing cybersecurity related risks are integrated into the Company's overall Organization Risk Management (ORM) program. Cybersecurity related risks are included in the risk universe that the ORM program evaluates to assess top risks to the enterprise on an annual basis. To the extent the ORM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: The Board of Directors is responsible for general oversight of the Company's risk management program, including cybersecurity risks. The Board of Directors receives an annual report from senior management through the ORM program and material risk assessments and mitigation strategies, including with respect to cybersecurity risks.


text: The Audit Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align the Company's risk exposure with its strategic objectives. The CIO provides periodic updates to the Audit Committee on the status of the Company's cybersecurity risk management program; the Company's information systems, cybersecurity, data privacy and other risks; and the steps management has taken to identify, monitor and mitigate such risks. The Audit Committee is also briefed on cyber crisis contingency planning and incident recovery capabilities and matters related to any material cybersecurity incident the company may experience.


text: As trusted partners to healthcare providers, patients, biopharmaceutical companies, academic and non-profit institutions, business partners and employees, we appreciate the importance of maintaining a comprehensive and trustworthy information security program. Our information security program is fully integrated into our operations, and a hallmark of our program is its cross-functional approach with our internal privacy objectives and stakeholders.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: The Company's business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but the Company cannot provide assurance that it will not be materially affected in the future by cybersecurity risks, threats or incidents. See Item 1A under the caption "Increased cybersecurity threats and more sophisticated computer crime pose a risk to our systems, networks, operations, products and services." for additional information on cybersecurity risks applicable to the Company.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan based on National Institute of Standards and Technology (NIST) 800-61.

companyName: Commerce.com, Inc.

ticker: CMRC


text: We design and assess our program based on a combination of the International Organization for Standardization (ISO) 27001, Center for Internet Security (CIS) 18, and the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements of these frameworks, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes but is not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • an annual tabletop exercise conducted by a third party to simulate a cyber emergency and practice our response to such a scenario; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for relevant service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors and Audit Committee jointly oversee management's implementation of our security organization, which is charged with assessing and taking steps to mitigate the data privacy and cybersecurity risks that we face as a software-as-a-service platform.


text: The Board and Audit Committee receive regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program. Board and Committee members receive presentations on cybersecurity topics from our Chief Technology Officer and others within the Chief Technology Officer's team, as well as other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Technology Officer and the Chief Technology Officer's team are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of experience across several public companies, including in the IT, cybersecurity, retail, and financial industries.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards. We also rely on these third party firms for educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.

companyName: Repay Holdings Corp

ticker: RPAY


text: Risk Management and Strategy Our Information Security Committee (the "ISC") oversees and implements a cybersecurity program that seeks to assess, identify and protect against cyber security threats and detect, respond, and recover from cyber security incidents. The program is modeled upon the National Institute of Standards and Technology Cybersecurity Framework, a well-established and widely adopted framework in the financial services industry. The ISC is chaired by our Chief Information Security Officer ("CISO") and membership includes executive and management level representation from our technology, legal, and compliance departments.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Our cybersecurity program assesses our cybersecurity risk profile through inventories of physical devices, software, and information systems, evaluations of critical third-party systems, and a catalogue of security risks. Periodic assessments are conducted to ensure the risk catalog is up to date.


text: We protect our information systems, data, and network through technical and procedural controls and security awareness training. We deploy multiple technical controls to achieve a layered security strategy including systems access controls, firewalls, web application gateways, antivirus software, e-mail filtering, and endpoint protection. Security awareness training is mandatory for all employees and conducted at hire and periodically on topics such as phishing, ransomware, social engineering, public Wi-Fi risks, password security, and mobile device security. Training is supplemented by testing initiatives, including periodic phishing tests, which may result in targeted or remedial training.


text: We use a third-party security operations center and endpoint management and response service to continuously monitor information systems for emergent events including anomalous, suspicious, and unauthorized network activity. Detected events are immediately triaged and evaluated for threat potential and impact. We also engage third-party providers to perform penetration testing designed to identify vulnerabilities for remediation. We rotate penetration testing providers to diversify testing approaches.


text: At this time, we are not aware of any risks from cybersecurity threats, including as a result of any previous cyber security incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our efforts to prevent and detect cybersecurity threats and incidents, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional discussion about cybersecurity-related risks.


text: Role of the Board of Directors and Management The Audit Committee of the Board of Directors oversees our enterprise risk management, which includes cybersecurity. The Chair of the ISC reports on our cybersecurity program to our Board at least annually.


text: Our CISO and Chief Technology Officer ("CTO") oversee our day-to-day technology and security activities. Our CISO has been with the firm since 2013 and has over 20 years of IT experience in various industries. He is a Certified Chief Information Security Officer from the Carnegie Mellon University executive education program, as well as a Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP). Our CTO joined the firm in 2020 with 25 years of IT experience, including 12 years of executive level technology experience in the asset management industry.


text: The CISO serves as the Chair of the ISC which serves as the steering committee for aligning our overall security strategy with business objectives and is responsible for overseeing the cataloguing of cybersecurity risks and assessments described above. These risks are carried through to our management-level Enterprise Risk Committee which maintains a broader inventory of risk, providing another layer of governance oversight. The third-party security operations center and endpoint managed detection and response service is overseen by the CISO. Management also maintains a Vendor Oversight Committee which provides additional governance over the risks associated with use of third-party vendors, including cybersecurity risk. The Chair of the Enterprise Risk Committee and the Vendor Oversight Committee also reports on its activities to the Audit Committee at least annually.


text: In the event of a potential cybersecurity incident, the third-party security operations center is authorized to take preemptive action to address the incident and must promptly notify a member of the ISC. The ISC coordinates the response to and communication of an incident in accordance with our Incident Response Plan ("IRP") and applicable law. The IRP is designed to provide guidance for effective, efficient, and orderly response to a variety of cybersecurity incidents. The ISC is responsible for communication escalation as necessary up to and including to the Board of Directors.


text: Alight recognizes the importance of developing, implementing and maintaining robust cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity and availability of the data in our care. The Company utilizes a cross-functional group of colleagues representing various stakeholders including technology, security, finance, internal audit, legal and others to identify and manage risks across the organization, including risks relating to cybersecurity.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: The Company's cybersecurity program is focused on continuous improvement and takes a layered approach to cybersecurity to include prevention, detection, and response-based controls. Our preventative measures include network-based controls, malware defenses, email security, encryption for data in motion and at rest, continuous vulnerability testing and mitigation, and multi-factor authentication. Our detection and response measures include comprehensive logging and continuous monitoring utilizing both in-house and Managed Security Services, forensics capability, and an enterprise crisis management function.


text: To support the overall cybersecurity program, Alight maintains an incident management team that tracks and logs privacy and security incidents across Alight, our vendors, and partners to better manage remediation and resolution of any such incidents. Significant incidents are promptly reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is escalated for further review, and then reported to designated members of our executive leadership team where needed. We consult with outside counsel and forensics firms as appropriate, including on materiality analysis and disclosure matters, and members of our executive leadership team make the final materiality determinations and, if appropriate, disclosure to law enforcement, regulators or clients. Our executive leadership team apprises Alight's Board of Directors and our independent public accounting firm of significant matters and any relevant developments.


text: Our cybersecurity frameworks are informed by third-party standards relevant to our industry such as the National Institute of Standards and Technology, the Center for Internet Security and the International Standards Organization. We regularly test our cybersecurity defenses through both automated and manual testing to identify, prioritize and remediate risk. Alight also engages third parties to examine and report on the effectiveness of our controls relating to our systems, including those used in the cybersecurity frameworks.


text: Our Chief Technology and Delivery Officer, Chief Information & Security Officer and Chief Legal Officer provide periodic reports on our cybersecurity and risk management efforts, including with respect to information security practices, to the Audit Committee of our Board of Directors (the "Audit Committee"), as well as to other members of our executive leadership team, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Where appropriate, the Audit Committee then periodically reports to the full Board of Directors regarding the Company's assessment of potential risk exposures and the steps management has taken to monitor and control such risks, which includes the Company's cybersecurity program designed to prevent, detect, and rapidly respond to any potential incident. In addition to our scheduled meetings, the Audit Committee and executive leadership team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in cybersecurity to facilitate proactive and responsive oversight. The Audit Committee is apprised of strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement helps drive integration of cybersecurity considerations into our Company's broader strategic objectives.


text: Additionally, because Alight partners with a number of third parties in the ordinary course of business, our management team has developed and implemented processes to oversee and manage significant risks associated with use of third-party service providers. We conduct thorough security assessments of critical third-party providers before engagement and periodically monitor vendor compliance with our security standards. The monitoring includes periodic assessments by our vendor management team and use of an independent vendor risk rating service that alerts Alight when there is a change in a service providers security posture. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Our Chief Information & Security Officer has over 30 years of experience in the cybersecurity industry, including, prior to joining Alight in 2021, as the SVP, Chief Information Security Officer at a multinational health insurance and health services company in the Fortune 100, and as head of cybersecurity for a U.S.-based financial services company in the Fortune 500, as well as for a federal banking institution and for a professional services company in the Fortune 500 specializing in information technology services. Our Chief Information & Security Officer reports directly to the Chief Technology and Delivery Officer and meets regularly with other members of senior management and the Audit Committee.


text: Our program is regularly evaluated by internal stakeholders and external parties with the results of those reviews reported to the executive leadership team and the Audit Committee, as appropriate. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future incidents. For more information on our cybersecurity related risks, see the Risk Factors in Item 1A. of this Annual Report.


text: The Board receives regular updates from the Computer Security Incident Response Team ("CSIRT") to provide insight into significant cybersecurity risks, potential impacts on business operations, and management's strategies for identifying, monitoring, and mitigating these risks. This includes sharing results from assessments or audits of relevant processes.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: Cybersecurity Risk, Management, and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. The Information Security Officer is primarily responsible for administering, updating and enforcing the cybersecurity components of the risk management strategy and reports to the Chief Risk Officer. The Information Security Officer periodically collaborates with third-party service providers and industry groups to discuss cybersecurity trends and best practices. The Information Security Officer is supported by the Chief Technology Officer, who reports directly to the Chief Financial Officer. The Chief Technology Officer oversees our Information Technology department, comprising our first line of defense.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. To manage cybersecurity risk, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. The cybersecurity strategy is memorialized within the Company's information security program. The program incorporates regulatory guidance and industry standards while leveraging industry associations, third-party benchmarking, audits, threat intelligence and peer industry groups. The information security program is reviewed by the Chief Risk Officer and presented to the Risk, Compliance and Planning Committee to periodically account for the changes in the cyber threat landscape. It is also periodically assessed by the Internal Audit department.


text: The Company has deployed an in-depth cybersecurity strategy to protect its assets, which includes a diverse preventive and detective tool set to stop, monitor, and alert management of suspicious activities and potential advanced persistent threats. We have implemented other preventive technologies and mitigating processes to include on-going education and training for employees, periodic tabletop exercises and recovery tests, and regular infrastructure penetration tests conducted by cybersecurity professionals and third-party specialists. Our internal and external auditors, along with independent external partners, periodically assess our processes, systems and controls for design and operating effectiveness, and provide recommendations to bolster our cybersecurity program. In addition, employees are subjected to regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. We also monitor our email gateways for malicious phishing emails and monitor remote connections through a secure virtual private network. Like many companies, we rely on third-party vendor solutions to support our operations. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence. We have a vendor management program in place to assess and manage risks associated with third-party service providers.


text: To prepare to respond to incidents, the Enterprise Risk Management Committee periodically reviews and updates our cyber Incident Response Plan ("IRP"). The IRP provides a framework to address potential and actual cybersecurity incidents to include assessment to recovery by our Incident Response Team and notification to the appropriate management and board committees and regulatory agencies. The Incident Response Team is comprised of representatives from various departments including Information Security, Risk Management, Legal, Operations, Marketing and Accounting. Our Information Security Officer manages the Incident Response Plan and coordinates with senior level management and multiple areas of the company in execution of the plan. While we have experienced cybersecurity incidents, we have not, to our knowledge, experienced an incident materially affecting, or reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Information Security Officer is accountable for managing the information security department and executing the information security program. The information security department is responsible for cybersecurity risk assessments, alert monitoring, incident response, vulnerability assessment, threat intelligence, identity access governance, and third-party information security risk management. The department consists of information security professionals with varying levels of education, experience and certifications. Our information security department is further supported by our first line of defense, the Information Technology department and a third-party managed service security provider.


text: The Risk, Compliance and Planning Committee of our Board of Directors provides oversight of the information security program including cybersecurity and is chaired by an independent director. Cybersecurity metrics are reported to the committee quarterly. Additionally, management has established an Information Technology Executive Steering Committee focused on, technology impact, and an Enterprise Risk Management Committee focused on business and risk impact, both consisting of executives and department leaders across multiple domains. These committees generally meet quarterly and more frequently when warranted. The information security department holds a monthly security meeting with the managers from the information technology department to discuss significant security incidents and status of the threat landscape. The Information Security Officer reports significant cybersecurity or privacy incidents and the state of the information security program to the Risk, Compliance and Planning Committee of the board on a quarterly basis. The Risk, Compliance and Planning Committee of the Board of Directors provide a report of activities to the full board at each quarterly board meeting.


text: As an important part of our cybersecurity programs, we perform defined due diligence procedures prior to engaging with new vendors. The level of due diligence varies depending on the materiality, level of risk and complexity of the arrangements. The vendors' financial condition, information security programs and regulatory reporting are also typically reviewed and considered prior to entering into a vendor agreement.


text: The Board's Audit Committee oversees risks relating to cybersecurity threats and the steps management takes to monitor and control such exposures. The Company has instituted an Information Security Incident Response Plan ("IRP") which provides a framework to assist the Company in responding to actual or potential cybersecurity incidents. Our IRP includes detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be executed from detection to assessment to notification and recovery, including internal notifications to the Audit Committee as appropriate. These incidents may consist of any actual, threatened, suspected, or reported event or occurrence that may affect the confidentiality, integrity, or availability of Company systems or data, or of any such event affecting a third party that may affect Company systems or data. The objective of the IRP is to facilitate a timely and coordinated enterprise-level response to such incidents to mitigate impact on the Company and its employees, stockholders, customers, business partners, and other stakeholders. The Audit Committee receives regular reporting from senior officers (such as the Chief Information Security Officer and the Director of Risk Management & Insurance) on operational risk and the steps management has taken to monitor and control these risks. Such reporting includes updates on the Company's IRP, the external threat environment, and the Company's programs to address and mitigate the risks associated with the cybersecurity threat environment. The IRP and internal controls around cybersecurity are periodically evaluated by external experts and the results of those reviews are reported to the Audit Committee.

companyName: BRUKER CORP

ticker: BRKR


text: The Company has established a corporate-level global Information Security Incident Response Team ("ISIRT"), which provides a centralized, coordinated response to, and management of, cybersecurity incidents that may present significant risk to the Company's operations, valuation, brand or reputation, employees, and customer or business relationships. The Company's cybersecurity response team is comprised of multiple subject-matter experts, including information technology, cybersecurity and risk management members with a combined experience of well over 60 years. Core members of the ISIRT consist of the Vice President, Financial Operations and Project Management ("Financial Ops"); Senior Vice President, General Counsel, and Corporate Secretary ("General Counsel"); Chief Information Security Officer ("CISO") who reports to the Chief Information Officer ("CIO"); Chief Privacy Officer ("CPO"); Vice President, Corporate Treasurer ("Treasury"); Director, Risk Management & Insurance ("Risk Management"); and Cyber Security Manager ("Information Security"). If a cybersecurity incident warrants activation of the ISIRT, the Company's Financial Ops and the General Counsel will notify, as appropriate, the Company's executive leadership and the Audit Committee. We also engage specialized third-party consultants to proactively support our cybersecurity efforts, which include but are not limited to, application and network security, information risk management, as well as business continuity and disaster recovery.


text: Cybersecurity incidents may occur at, or be reported to, any of the Company's facilities worldwide. The Company has an IT Service Desk which acts as the single point of contact for cybersecurity incident reporting. Employees can notify the IT Service Desk of any event that they observe or is reported to them that may constitute a cybersecurity incident. Once notified, the IT Service Desk team conducts an initial classification and escalates, when needed, to the CISO and other members of ISIRT as per the Company's IRP. Financial Ops, in consultation with the General Counsel, CPO and CISO, decide whether to activate the ISIRT in connection with any escalated incident. When activated, the ISIRT coordinates and directs all aspects of the response, including, as applicable, investigation, containment, business continuity and recovery, remediation, notifications, communications, and post-incident activities with executive leadership, including the CIO, and the Audit Committee and/or Board of Directors, as appropriate in the circumstances. As of December 31, 2023, no identified risk has required activation of the ISIRT.


text: In addition, our third-party service providers play a role in our risk management and strategy as well as with the investigation of cybersecurity incidents. Based upon the assessment of the type of incident and risk presented, the ISIRT engages outside counsel and/or external resources, such as forensic consultants, to conduct or assist with cybersecurity investigations in order to provide advice to the Company. The vendors we engage with are globally recognized companies with expertise in cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.


text: For a discussion of information technology rights that may materially impact us, see Item 1A "Risk Factors—We rely on information technology to support our operations and reporting environments. A security failure of that technology, including with respect to cybersecurity, could impact our ability to operate our businesses effectively, adversely affect our financial results, damage our reputation and expose us to potential liability or litigation."


text: Cybersecurity Governance The Board of Directors takes an active role in overseeing management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure and our strategies for dealing with this risk with our long-term objectives. The Board has delegated the cybersecurity risk oversight function to the Audit Committee. To support our Audit Committee in this function, our Audit Committee has engaged a third-party expert to advise it and the Board on cybersecurity matters, including oversight of the Company's continued development, evolution and investments in cybersecurity infrastructure, policies and practices. Senior leadership, including our CIO and CISO, brief the Audit Committee quarterly, or more regularly, as needed, on the Company's cybersecurity program, including cybersecurity risks, business-impacting incidents and ongoing and future cybersecurity project status. In addition, the Audit Committee's third-party cybersecurity advisor meets regularly with the CIO and CISO to review our cybersecurity strategy and key initiatives and progress toward meeting our objectives. The Audit Committee reports to the full Board at least quarterly regarding its oversight of cybersecurity risks, events, developments and other related matters, as relevant. The full Board also periodically receives briefings from management on our cybersecurity risk management program.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management program is designed to assess, identify and manage material risks from potential unauthorized breaches of or access to our electronic information systems and the information we store on our systems. Our program includes a wide variety of mechanisms, controls, technologies, methods, systems and other processes as further described below that are designed to prevent, detect or mitigate unauthorized access, data loss, theft, misuse or other security incidents and vulnerabilities affecting our systems and the information we store on our systems. The information we store includes confidential, proprietary, business and personal information of ours, our customers, our employees and other third parties that we collect, process, store and transmit as part of our business. Our program is aligned with the National Institute for Standards and Technology Risk Management Framework (NIST RMF), other industry-recognized standards and our contractual requirements. We also leverage government partnerships, industry and government associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds and other similar resources to inform and guide our cybersecurity processes and resource allocation. Additionally, we use processes and third-party technologies to oversee and minimize impact to our data, including two-factor authentication, encryption, Company secured email and dedicated cybersecurity support personnel.


text: Our cybersecurity risk management strategy is led by our Chief Information Security Officer (CISO) and a team of information security and other professionals, as detailed further below, who are responsible for implementing and maintaining our cybersecurity data protection practices. This team works in close coordination with the Audit Committee of our Board of Directors, which is responsible for oversight of cybersecurity risk, senior management and other business functions and teams across the Company to identify threats by performing risk assessments and analyzing effectiveness of controls against identified risks.


text: As part of our risk management process, our cybersecurity risk management team oversees our vulnerability management practices and conducts routine application security assessments, yearly penetration testing, periodic security audits and ongoing risk assessments designed to identify cybersecurity risks to our environment. We also subscribe to third-party services for security operations through a dedicated managed security service provider responsible for mitigating threats to our environment and alerting and responding to events and incidents in coordination with our team. In addition to our routine practices, we also conduct testing, audits and assessments in connection with acquisitions, the implementation of new software, processes or activities requiring changes in our information technology environment, new cybersecurity events or developments and receipt of new risk intelligence. Further, we have adopted an enterprise-wide cybersecurity training and awareness program requiring all employees to complete annual cybersecurity training. The program is supported with monthly education and simulations with remedial training assignments to increase user awareness.


text: We maintain an incident response plan (IRP) aligned with National Institute for Standards and Technology Risk Management Framework (NIST RMF) when responding to incidents. The IRP sets out a coordinated approach to investigating, containing documenting and mitigating incidents. Our CISO, with oversight from our Chief Information Officer (CIO), is responsible for executing the relevant cybersecurity incident response plan, which includes response criteria for materiality, applicable requirements for incident disclosure and reporting and escalation procedures to various individuals and departments, including our Audit Committee, Senior Management, Key Stakeholders, General Counsel, Chief Financial Officer and Chief Executive Officer, for risks with a potentially material impact for responding to cybersecurity incidents. In addition to our in-house team and third-party security operations services, we also engage assessors, consultants, auditors and other third parties from time to time to assist with assessing, identifying and managing cybersecurity risks. For example, we leverage third-party security and compliance companies with subject matter expertise in these areas for threat identification and remediation. We continue to work with the U.S. Department of Defense on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks, including through participation in the Department of Defense's collaborative information sharing. We also partner with other work groups to support understanding and deployment of the Cybersecurity Maturity Model Certification (CMMC) to promote readiness in complying with cybersecurity requirements for handling CUI and federal contract requirements.


text: As of December 31, 2023, we were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: In the event of a potentially material cybersecurity event, pursuant to our incident response plan, in addition to notification and involvement of our General Counsel, Chief Financial Officer and Chief Executive Officer, among others, the Audit Committee would be notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate.


text: Our management team, including the Director of IT Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 20 years of Information Security experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.

companyName: Paragon 28, Inc.


text: In collaboration with third-party experts, our corporate cybersecurity organization is led by our CISO, reporting to our CIO. The CIO has more than 20 years of experience as a CIO and in technology leadership positions, with deep expertise in technical strategy, data management, infrastructure and cybersecurity. Our CISO has 25 years of experience in information technology, governance, compliance and risk management and is a Certified Information Security Manager (CISM), which is an advanced certification indicating an individual possesses the knowledge and experience required to develop and manage an enterprise information security (InfoSec) program. The CISO is responsible for our overall cybersecurity strategy, policies, security operations and threat detection and response. The cybersecurity organization manages and continually enhances the maturity of our security posture with the goal of preventing or mitigating cybersecurity incidents to the extent feasible, while increasing system resiliency to minimize business impact.


text: At the management level, we have established an Enterprise Cybersecurity Council, which includes our CIO, CISO, Director of Information Security, Director of Infrastructure, Senior Security Architects and Engineers, that meets monthly to identify opportunities to further strengthen our cybersecurity risk management program, including with respect to the prevention, detection, mitigation and remediation of cybersecurity incidents. This group is responsible for developing and coordinating risk identification and remediation, performance metrics and policy enforcement and providing guidance to management and oversight bodies. Members of the group have significant cybersecurity experience and hold a number of certifications, including CISM, Certified Information Systems Security Professionals (CISSP), Certified Ethical Hacker (CEH), and Cisco Certified Network Associate (CCNA).


text: Cybersecurity Risk Management and Strategy We recognize the critical importance of safeguarding our information systems and data against evolving cybersecurity threats. Our program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, preventative tools and technologies, monitoring and detection tools, and regular backup protocols. Additionally, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. The results of these assessments are reported to the Audit Committee.


text: We assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop remediation or mitigation controls and safeguards. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: Our cybersecurity risk management program includes: • Risk Assessment: Regular assessments identify and prioritize technical risks to critical assets through threat identification and vulnerability assessments. • Risk Identification and Analysis: Prioritization of risks is based on standardized scoring frameworks, focusing resources on addressing the most significant threats. • Risk Mitigation and Management: A range of controls and measures are implemented to mitigate identified risks, incorporating technical and procedural safeguards. • Monitoring and Detection: Continuous monitoring systems are deployed to detect potential security incidents in real-time, ensuring a 24x7x365 capability to respond and mitigate. • Cybersecurity Training and Awareness: New hire, annual, and ongoing security awareness training is given to all employees. • Incident Response: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. • Continuous Improvement: Commitment to continuous improvement is reflected in regular reviews, updates of risk assessments, and simulated cyberattacks to identify and remediate risks from existing and emerging threats.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status on key information security initiatives.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: We conduct periodic risk assessments to identify cybersecurity threats and assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our VP of Information Technology, who reports to our General Counsel & Head of Operations, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards in collaboration with management. Personnel at all levels and departments know our cybersecurity policies through training. Random attack simulations are conducted monthly to familiarize all personnel with various phishing methods with positive reinforcement on identifying and reporting suspicious content to the IT Department.


text: We engage third parties like a penetration testing firm and our managed service provider (MSP) in connection with our risk assessment processes. These service providers assist us in identifying vulnerabilities to design and implement, suggesting remediation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operation."


text: One of the key functions of our board of directors is oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers manage the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole and through the audit committee.


text: Our VP of Information Technology, and our management committee on cybersecurity, which includes the Company's audit committee, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The VP of Information Technology has twenty years of experience in IT on-premise and cloud infrastructure, enterprise applications, and operations across large and mid size life science companies with a focus on IT controls for compliance an security.


text: Our VP of Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our VP of Information Technology or department designee are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include weekly assessments for all endpoints and real-time notifications from security solutions, which include a combination of cloud and client-based applications.


text: Our VP of Information Technology provides annual briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our VP of Information Technology or department designee provides annual briefings to the board of directors on cybersecurity risks and activities.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: BOX INC

ticker: BOX


text: The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company relies on the Investment Advisor to implement the cybersecurity program. The cyber risk management program involves risk assessments relating to the information systems of the Investment Advisor, incident response training and testing, implementation of security measures, and ongoing monitoring of systems and networks and assessment of the associated risks on an annual basis, including networks on which the Company relies on. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Investment Advisor has engaged external experts, including consultants, to evaluate cybersecurity measures and risk management processes. The Company depends on and engages various third parties, including suppliers, vendors, and service providers. The compliance team of the Company and the Investment Advisor will conduct onboarding and ongoing due diligence of each third-party engaged by them, including identify and oversee risks from cybersecurity threats associated with their use of such entities.

companyName: FIDUS INVESTMENT Corp

ticker: FDUS


text: Board Oversight of Cybersecurity Risks The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to the Company's risk management, including risks associated with cybersecurity threats. Certain members of the Company's management will periodically report to the Board, on at least a quarterly basis, on cybersecurity matters, such as the overall state of the Company's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and material cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management The Company's management is responsible for assessing and managing material risks from cybersecurity threats, in consultations with cybersecurity consultants engaged by the Investment Advisor. The Company's management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, and/or information technology.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes has materially affected, or are reasonably likely to materially affect, the Company, including the Company's business strategy, operational results, and financial condition.


text: We maintain various protections designed to safeguard against cyber attacks, including access controls, firewalls and virus detection software. We have established and test our disaster recovery plan and we protect against business interruption by backing up our major systems. We periodically scan our environment for any vulnerabilities and engage third parties to perform annual penetration testing and assess effectiveness of our information security practices. In addition, we maintain insurance that currently includes cybersecurity coverage.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: In the normal course of business, we also collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, customer information including bank account information and invoice and payment information, sensitive third-party information and employee information, and certain personal information. To protect this information and our systems, our existing cybersecurity policies require monitoring and detection programs, network security measures, and encryption of critical data. Additionally, we have processes in place that are designed to assess and manage cybersecurity risks associated with our use of third-party service providers.


text: Governance—Board Oversight and Management's Role in Assessing and Managing Cybersecurity Risks Our board of directors and Chief Executive Officer have ultimate accountability for risk and establishing the risk-culture of the Company. This includes oversight of our risk management program, which includes risks from cybersecurity threats. Our board of directors and Chief Executive Officer, including through the risk management committee of our board of directors, provide oversight to ensure the appropriate measures are in place so that management can identify, assess, prioritize, and respond to risk, including cybersecurity risks. We believe our board of directors, the risk management committee of our board of directors, and our Chief Executive Officer collectively have the requisite experience, knowledge, inquisitiveness, and visibility into the design and operation of our information security practices to fulfill this responsibility effectively.


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks At an operating level, our cybersecurity program is led by our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"). Our CIO and CISO have over 45 combined years of information technology and cybersecurity experience with skills sets that span architecture and design, risk assessment, incident and remediation management, department development, companywide training, and the creation and implementation of cybersecurity compliance programs that address administrative, physical, and technical safeguards.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Item 1A—Risk Factors" in Part I of this Annual Report on Form 10-K, including the risk factor captioned, "Significant disruptions of information technology systems or actual or alleged breaches of data security could adversely affect our business."

companyName: CERUS CORP

ticker: CERS


text: Our cybersecurity program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity leadership regularly reports to the board of directors and its audit and risk management committees on information security and cybersecurity matters. For example, the risk management committee in conjunction with management and our enterprise risk management team reviews and discusses on at least a quarterly basis certain cybersecurity metrics that include reporting on phishing incidents and training, vulnerability management, security incident trends, detection and response effectiveness, recovery measures and incident resiliency.


text: We have implemented policies, standards, and technical controls based on the National Institute of Standards and Technology ("NIST") framework with the aim of protecting our networks and applications, to safeguard the confidentiality of sensitive information entrusted to us. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our critical service providers and we, have security measures and programs in place designed to prevent, detect, and respond to cyber-attacks, security-related incidents, and other similar threats. However, our ability to monitor our vendors' cybersecurity practices is limited, therefore we cannot guarantee that our measures and programs will prevent a cyber-incident impacting our systems or information.


text: We continue to evaluate internal systems, processes, and controls to identify potential vulnerabilities and mitigate potential loss from cyber-attacks. We undertake an annual tabletop exercise to assess our response proficiency. We monitor critical and high risks and associated mitigation plans as well as a forward-looking information security roadmap that is aligned with the six functions set forth in NIST's Cybersecurity Framework: Govern, Identify, Protect, Detect, Respond, and Recover. The goal of this framework is to implement effective information security risk techniques and strategies, minimize operational and fraud losses, and enhance our overall performance. In addition, we have invested, and plan to continue investing, in resources to protect our information security ecosystem against cyber-attacks, other security-related incidents, and data breaches and to investigate and remediate any information security vulnerabilities.


text: Our cybersecurity program has also focused on company-wide training on phishing and other social engineering attacks. Management takes the position cybersecurity is owned company wide as a collective team, not just by the organizations of the Chief Information Officer and Chief Information Security Officer. Our newest security awareness platform was deployed in the first quarter of 2024 to improve awareness through assessments, training, realistic phishing campaigns, and immediate feedback. All-hands briefings, updates on metrics, and "tips and tricks" supplement our platform and address gaps in awareness. Key areas of focus in 2024 will include challenging employee-teammates with real-world social engineering techniques and encouraging the reporting of phishing to improve resiliency.


text: Material Impacts from Cybersecurity Threats and Incidents Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyber-attack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: In early April 2023, we detected a cybersecurity incident as part of our routine security monitoring protocols. In response to the incident, we undertook an investigation with the support of leading cybersecurity experts, reached out to law enforcement, accelerated planned security enhancements, and have taken and will continue to take actions to implement additional safeguards.

stage1Category: Incident Disclosure


text: The investigation determined that the incident primarily affected systems that were used for back-office activities. Data was exfiltrated from these systems and posted on the dark web. The data consisted of confidential information from our files, including personally identifiable information, primarily information of our employees, former employees, and their dependents, and the bank account information of some customers and other sensitive Company information. We cooperated with inquiries about the incident from three state consumer and financial service regulators, provided notices to impacted customers and individuals, and complied with regulatory requirements of various states that address notice and credit monitoring. We delivered all required notices during the fourth quarter of 2023 and consider our investigation to be complete.


text: During the fiscal year ending December 31, 2023, we incurred $5.4 million in response costs related to the incident, including professional services and legal fees, before insurance recoveries. We currently do not expect to experience material expenses and costs associated with our response to this cybersecurity incident during the 2024. While a loss from these matters is possible, we are unable at this time to reasonably estimate the possible loss or range of loss. Therefore, no liability for losses has been recorded related to the incident as of December 31, 2023.


text: The audit committee receives periodic briefings from our Chief Financial Officer, the Chair of the IT Security Steering Committee, regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties. Our audit committee provides periodic updates to the board of directors on such reports.

companyName: 89bio, Inc.


text: We maintain cyber insurance coverage and have tendered claims for certain expenses incurred in connection with this event. We will tender claims in future periods for costs incurred as of December 31, 2023. The extent to which our insurance will cover such expenses remains uncertain. As of December 31, 2023, we had recovered $1.7 million from our insurer. Insurance recoveries are recorded as a reduction of general and administrative expense. Refer to Note 15 to our Audited Consolidated Financial Statements for additional information concerning the incident. As a result of our cybersecurity incident in 2023, our cyber insurance premiums increased significantly following renewal and the number of insurers that submitted proposals to us for consideration during our renewal process was very limited.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, mitigate or remediate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident impacting our data at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Our cybersecurity team is led by our interim chief information security officer ("CISO"), who directs a unified cross-functional team that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at First Advantage. Our interim CISO has numerous years of experience at First Advantage and other organizations managing security infrastructure, providing a variety of security services, and overseeing incident response and management, escalation of security events, vulnerability scanning, and security defect management. Collectively, the interim CISO and our cybersecurity team act in close coordination with senior leadership and other teams across First Advantage. In addition to our extensive in-house cybersecurity capabilities, we engage assessors, consultants, auditors, or other third parties to help assess, identify, and manage cybersecurity risks.


text: Our cybersecurity risk management process forms a critical component of our overall risk management and business strategy. As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. Additionally, we utilize data encryption and access control, single sign-on and multi-factor authentication, and malware protection within our control environment. We also maintain a variety of incident response plans that are utilized when incidents are detected. These plans are designed to be flexible so that they may be adapted to an array of potential scenarios and provide for the creation of cross-functional cybersecurity incident response teams in the event of a cybersecurity incident. We regularly review our incident response plans and conduct multiple incident response exercises each year, including sessions with management, to test and assess our preparedness to respond to a cybersecurity incident. Additionally, we require employees with access to our information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.


text: As part of our incident detection and response processes, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within First Advantage (including the interim CISO, Chief Financial Officer, and General Counsel) and to the Audit Committee and Board of Directors based on incident materiality. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our interim CISO, our Chief Global Compliance Officer, and our General Counsel.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and related mitigation activities are also subject to oversight by the Audit Committee of our Board of Directors. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks, including management's response to any significant cybersecurity incidents. The Audit Committee receives regular reports, from our interim CISO and Chief Technology Officer, regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items, and reports to the Board of Directors at least quarterly.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Our cybersecurity program is based on the ISO 27001 security controls set, and in particular, it focuses on the principles of confidentiality, integrity and availability. We maintain an ISO 27001 certification with a fully integrated set of operational policies and procedures to adhere to the 14 domains of ISO 27001. This includes but is not limited to the organization of information security to assign roles and responsibilities within Adaptive, access control to restrict employees' access to view only that information that is relevant to their roles, information security incident management, and compliance to broadly ensure alignment with applicable laws and regulations. We perform an annual risk assessment conducted by an outside assessor and operate a vendor risk assessment program for third party vendors to evaluate how their systems may impact our business in the event of a cybersecurity incident. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.

companyName: Adaptive Biotechnologies Corp


text: The internal body with executive oversight of our cybersecurity program is our Privacy and Information Security Steering Committee ("PISSC"), which applies a multidisciplinary framework to cybersecurity risks and risk assessment by integrating information security, privacy and human resources expertise, oversight and reporting. The PISSC is made up of our Head of Security, Privacy Officer, Chief Operations Officer, Chief Financial Officer, General Counsel and Chief People Officer and meets on a quarterly basis. Our Head of Security is a senior information security professional with more than 20 years of experience implementing and leading security programs. Our Head of Security holds an undergraduate degree in computer science, has a Six Sigma certification in Total Quality Management and is a Certified Information Systems Security Professional ("CISSP").


text: Our board of directors is kept apprised of cybersecurity risks and assessments through regular presentations to the Audit Committee regarding our information security and privacy governance and reports on information security and privacy incidents. Cybersecurity threats, including as a result of any past cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see the "Risk Factors" section.


text: Cybersecurity Risk Management and Strategy Cybersecurity is an integral part of risk management at the Company, and we and Hess share a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. We rely primarily on Hess' cybersecurity risk management program and processes, including policies, controls or procedures, which includes a cybersecurity incident response plan as well as our own property and casualty insurance that may cover damages caused as a result of a cybersecurity event.

companyName: Hess Midstream LP

ticker: HESM


text: We and Hess design and assess the program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we or Hess meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our businesses.


text: Our cybersecurity risk management program is integrated into the overall enterprise risk management program overseen by Hess' Chief Risk Officer, who also serves as our Chief Financial Officer, and shares certain methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other areas affecting our and Hess' business risks, including financial, compliance, EHS and governance matters, among other topics.


text: The Company's and Hess' cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to critical systems integral to our services as well as the activities of our business partners and our broader enterprise information technology environment; • a security team principally responsible for managing cybersecurity risk assessment processes, security controls and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • ongoing cybersecurity awareness and compliance training that occurs quarterly and is mandatory for all Hess employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: The Company has not identified risks from known cybersecurity threats during the year ended December 31, 2023, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Additional information about cybersecurity risks we face is discussed in Part I, Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology and infrastructure used by us, Hess or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.


text: Reporting to the Board of Directors The CISO and Chief Information Officer ("CIO") regularly update the Board's Risk Management Committee on cybersecurity risks that the Company faces and the risk mitigation strategies that the Company employs to respond to those risks, with meetings generally occurring quarterly.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: Cybersecurity Governance Our general partner's board of directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection and mitigation of the effects of any such incidents on the Company. The board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee primary responsibility for oversight of the Company's risk management practices, including oversight of cybersecurity and other information technology risks.


text: The audit committee oversees the implementation of our cybersecurity risk management program. The committee receives presentations on cybersecurity topics from management at least twice a year, including the nature of threats, defense and detection capabilities; incident response plans; and Hess employee training activities. In addition, management updates the committee, as necessary, regarding any material cybersecurity incidents as well as other incidents with lesser impact potential. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: We rely on Hess' management team – including the Chief Risk Officer, the Head of Information Technology and the Chief Information Security Officer ("CISO") – for assessing and managing our material risks from cybersecurity threats. The team is primarily responsible for our overall cybersecurity risk management program and supervises both Hess' internal cybersecurity personnel and retained external cybersecurity consultants. Hess' Chief Risk Officer, who also currently serves as our Chief Financial Officer, has nearly 20 years of experience in this role and previously served as a consultant with Ernst & Young LLP's Risk Management and Regulatory Practice, where he assisted financial services and energy trading clients in establishing their risk management infrastructure. Hess' Head of Information Technology and Hess' CISO each have over 20 years of experience in information technology leadership in oil and gas. Furthermore, Hess' CISO holds a Bachelor of Science in Cyber and Data Security from the University of Arizona and is a Certified Information Systems Security Professional.