text: We engage assessors, consultants, and auditors in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. For further information, please refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to our Business: Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, or use or other processing of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK

secItem: Item 1C

stage1Category: None/Other

stage1Method: majority


text: Our Chief Financial Officer and Senior Director of Information Technology are primarily responsible for assessing and managing our material risks from cybersecurity threats w ith assistance from third-party service providers. Our Senior Director of Information Technology leads our internal team and has over 20 years of cybersecurity experience, including the last 10 years in leadership positions, enabling him to build and transform successful cybersecurity programs and initiatives across several enterprises. His active associations include Veteran Volunteer Instructor for US Cyber Army Command (ARCYBER), Information Systems Security Association (ISSA), and Forum of Incident Response and Security Teams (FIRST), and has held many technical certifications including Strategic Planning, Policy, and Leadership (GSTRT), Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP). Our third-party vendors include assessors, consultants, and auditors holding (but not limited to) the following relevant certifications: Certified Information Systems Security Architecture Professional (CISSP-ISSAP), Certified in the Governance of Enterprise IT (CGEIT), Certified Data Privacy Solutions Engineer (CDPSE), and Certified Ethical Hacker (CEH).

stage1Category: Management Role


text: Our Chief Financial Officer and Senior Director, Information Technology oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which o ur Chief Financial Officer and Senior Director, Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include company incident management and data protection policies, and applicable cybersecurity incident response playbooks.


text: Our Chief Financial Officer and Senior Director, Information Technology provide periodic briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Cybersecurity Risk Management and Strategy All companies utilizing technology are subject to cybersecurity threats. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, extortion, harm to employees or customers and violation of data privacy or security laws. We aim to incorporate best practices throughout our cybersecurity program. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees to help identify, avoid, and mitigate cybersecurity threats; policy regarding cybersecurity; mechanisms to detect and monitor unusual network activity; and containment and incident response procedures. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: Direct Digital Holdings, Inc.

ticker: DRCT

stage1Category: Risk Management Process

stage1Method: unanimous


text: In the event of an incident, we intend to follow our detailed incident response policy and procedure, which outlines the steps to be followed from incident detection to mitigation, including notifying functional areas (e.g. legal), as well as senior leadership and the board of directors, as appropriate. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Any significant disruption to our service or access to our systems could affect our business and results of operations. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. For more information regarding risks surrounding cybersecurity, please see "Risk Factors" of this Annual Report on Form 10-K.


text: In the past two fiscal years, we have not identified any risks from cybersecurity threats that have materially affected (or are reasonably likely to materially affect) our business, results of operations, or financial condition. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

stage1Category: Strategy Integration


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has ultimate oversight regarding our cybersecurity with our audit committee specifically assisting the board of directors in the role of risk oversight by regularly reviewing cybersecurity matters and reporting to the board of directors. The Company's Chief Technology Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters. Cybersecurity risk matters are reflected on reports and updates to operations management, senior management and our audit committee on a quarterly basis. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. To aid the board of directors with its cybersecurity and data privacy oversight responsibilities, the board of directors periodically hosts experts for presentations on these topics. For example, in 2023, management hosted an expert during the annual board of directors' retreat to discuss developments in the cybersecurity threat landscape. Our board of directors also engages in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

stage1Category: Board Governance


text: Anu Pillai, our Chief Technology Officer, leads our cybersecurity efforts. She has been serving in her current role since March 2021. Ms. Pillai has over 20 years of experience serving companies across multiple industries in senior management roles, within information technology and as such has developed substantial experience in cybersecurity, among other areas. Team members who support our Chief Technology Officer have similar broad experience and expertise in information security, including cybersecurity.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: P3 Health Partners Inc.

ticker: PIII


text: We design and assess our program based on the HITRUST Common Security Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the HITRUST Common Security Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the section titled "Risk Factors—Risks Related to Our Business and Industry—Our business and operations would suffer in the event of information technology system failures, security breaches, cyberattacks or other deficiencies in cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President of Technology and Director of Information Systems Security or other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Senior Vice President of Technology, Director of Information Systems Security, and Director of Information Systems Governance Risk and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience spans all aspects of information technology including cybersecurity, IT operations (infrastructure engineering and architecture design), and IT governance audit compliance across industries such as energy, healthcare, pharmaceuticals, and finance. Our Senior Vice President of Technology's experience includes over 30 years in technology leadership and management, with 25 years within the healthcare sector, specializing in cybersecurity programs, and establishing technology compliance programs with industry standards such as Sarbanes-Oxley, HIPAA, HITRUST, and NIST. Our Director of Information Systems Security's experience includes over 20 years in IT, with 12 years within the healthcare sector, managing risk assessments and leading security programs using the HITRUST framework to ensure compliance with HIPAA, NIST, ISO 27001, and GDPR. Our Director of Information Systems Governance Risk and Compliance's experiences includes over 25 years in IT audit and security governance, establishing and leading IT GRC programs, directing IT security initiatives, and maintaining relevant certifications including CDPSE, CRISC, and CISA.


text: Risk Management and Strategy The Company maintains cybersecurity processes, technologies and controls to help it assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of the Company's overall enterprise risk management process.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: Cybersecurity Risk Management At Katapult, cybersecurity risk management is an integral part of our overall enterprise risk management program and information security protocols. Our cybersecurity risk management program is based on industry best practices and Center for Internet Security Critical Security Controls for handling cybersecurity threats and incidents, including threats and incidents associated with the use of internally developed applications and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees throughout the year.

companyName: Katapult Holdings, Inc.

ticker: KPLT


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee of the board of directors. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee also reports material cybersecurity risks to our full board of directors. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Technology Officer, or CTO, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO and dedicated personnel are certified and experienced information systems security professionals and information security managers with over 15 years of experience and are certified information systems security professionals. Management, including the CTO and our cybersecurity team, regularly update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity, learning and training activities and updates to the company's cybersecurity programs and mitigation strategies.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors —Risks Related to Our Technology and Our Platform" in this annual report on Form 10-K.


text: Risk Management and Strategy We believe that our cybersecurity program provides effective protection of client information and of our operating systems from known and reasonably expected risks, while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we maintain up-to-date information security and monitoring controls, which we believe mitigates cybersecurity risks and threats while optimizing the utility of our systems. At the same time, cyberattacks are increasingly common, sophisticated and destructive, and several large, highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. These events also have carried significant reputational risk for the successfully targeted institutions. In order to mitigate these risks, our Information Security Officer ("ISO") is responsible for our cybersecurity programs and for the detection of and response to any identified threats and incidents. That individual also reports regularly to our Board of Directors, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems.

companyName: OP Bancorp

ticker: OPBK


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our procedures and security program are the guiding policies over our cybersecurity risk management. Additionally, our IT team uses the best currently available tools to help protect against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our employees are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.


text: Engaging Third Parties for Risk Management We recognize the complexity and evolving nature of cybersecurity threats, which is why we engage a range of external experts, including cybersecurity consultants, in evaluating and testing our risk management systems. Our IT security team partners with third-parties to perform annual penetration testing, vulnerability scanning, and monitoring of any potentially suspicious activity across the Company.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk function in coordination with the oversight and periodic review of the audit committee.

companyName: ESS Tech, Inc.

ticker: GWH


text: Oversight of Third-party Risk We also maintain a third party risk management program that applies to all third-party vendor relationships. Our Board of Directors has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to regarding strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews this policy on at least an annual basis to assure that we implement procedures and practices have been established by management. Our chief risk officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Company's strategic goals, risk appetite and the level of risk and complexity of its third-party relationships. This individual regularly reports to the Board of Directors regarding third-party risk management activities. The Company's internal audit staff also determines the frequency and scope of audits to examine the effectiveness of our third party risk management program.


text: The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management. As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity risks or threats that have materially impaired our business strategy, results of operations, or financial condition.


text: The Board recognizes the importance of managing risks associated with cybersecurity threats. The Board has established robust oversight procedures to promote effective governance in managing cybersecurity risks because of the significance of these threats to our operational integrity and shareholder confidence.


text: Board of Directors Oversight The Board Risk and Compliance Committee ("BRCC") is central to the Board's oversight of cybersecurity risks. The BRCC currently oversees various risk areas such as regulatory compliance, CRA, BSA/AMLA, enterprise risk management, cybersecurity, technology, and third-party risk management. The committee ensures that the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The BRCC reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include risk assessments of cybersecurity and related risks, as well as the company's vulnerability to those risks. The BRCC reviews an annual evaluation of the company's cybersecurity posture and the effectiveness of its risk management strategies, identifying areas for improvement and ensuring the cybersecurity efforts are integrated with the overall risk management framework.


text: Management's Role in Managing Risk The ISO plays a pivotal role in informing the BRCC on cybersecurity risks. Jointly with the Chief Risk Officer, the ISO reports quarterly to the BRCC on a range of topics, including: • Current cybersecurity landscape and risks; • Status of ongoing cybersecurity incidents, threats and strategies; • Internal and external test result and remediation efforts; • Enforcement of ongoing awareness training on information security; • Cybersecurity incident reporting and post-incident reviews; and • Compliance with regulatory requirements and evolving industry trends.


text: The ISO reports to the BRCC on the status and impact of any information security related developments and strategic initiatives, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the BRCC, the ISO, Chief Risk Officer, Chief Information Officer, and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. T he Company's Management Risk and Compliance Committee also reports directly to the BRCC regarding our risk management initiatives. The BRCC also receives quarterly reports from the Executive IT Committee and IT department in order to say informed on all aspects of cybersecurity risk affecting the Company.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the ISO, who has extensive cybersecurity program management experience working in various information security roles, including teaching as an information security instructor at a University. The ISO holds various information security qualifications, such as a doctoral degree in information technology and cyber security and holds the Certified Information Systems Security Professional ("CISSP") certification. The ISO and Chief Risk Officer are responsible for managing the disclosure and communications related to cybersecurity incidents. Our Chief Risk Officer chairs the Management Compliance and Risk Committee independently and has more than 20 years of experience in compliance and risk management.


text: We more fully describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under Item 1A. of this Form 10-K. See the risk factors captioned "We may experience difficulties in managing our growth and expanding our operations," "We are subject to cybersecurity risks to our and our suppliers' operational systems, security systems, infrastructure, integrated software in our LiDAR solutions and customer data processed by us or third-party vendors or suppliers, and any material failure, weakness, interruption, cyber event, incident, or breach of security could prevent us from effectively operating our business" and "Failures, or perceived failures, to comply with privacy, data protection, and information security requirements in the variety of jurisdictions in which we operate may adversely impact our business, and such legal requirements are evolving, uncertain, and may require improvements in, or changes to, our policies and operations."

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: Monitoring Cybersecurity Incidents The company utilizes various industry-leading systems to provide 24/7 threat detection and response capability, many of which provide proactive measures to shut threats down before they can harm the organization. Additionally, the company's incident response team periodically performs proactive measures, searching for potential indicators of threats, compromise, and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The ISO is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat is immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The ISO may determine that an incident has the potential to be materially relevant and would escalate that determination to the executive management, including Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, and other leaders and advisors of the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.


text: Reporting to Board of Directors The ISO, in his capacity as such, regularly reports to management and the BRCC on all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face. In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. These risks affect us, as well as our suppliers, customers, and ultimately their consumers.


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to, and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • adoption of frameworks established by the National Institute of Standards and Technology ("NIST") and International Organization for Standardization ("ISO") for a flexible, tailored, and risk-based approach to cybersecurity, helping to ensure a continuous process of identifying, protecting, detecting, responding, and recovering from cyber incidents; • alignment with ISO 21434 (automotive security) and ISO 27001 (information security management) standards, addressing cybersecurity aspects of automotive products and the broader information security management system to establish, implement, maintain, and continually improve confidentiality, integrity, and availability, as well as meeting the cybersecurity standards and product requirements established by our OEM customers; • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems; • providing cybersecurity training programs for employees, management, and directors, including conducting periodic phishing tests to promote awareness for all employees and all contractors with access to corporate email systems; • leveraging industry best practices for incident handling to help identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident, and participating in an industry information sharing and analysis center; • employing threat intelligence monitoring processes to model, research, and respond to cyber threats in a proactive manner; • closely monitoring emerging data protection laws and implementing changes to our processes accordingly; • undertaking a periodic review of public-facing policies and statements related to cybersecurity; • carrying information security risk insurance that may provide some protection against the potential losses arising from a cybersecurity incident; and • tracking key performance indicators pertaining to cybersecurity incidents, response and recovery, vulnerabilities, and risks. These approaches vary in maturity across the business and we work to continually improve them.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk management assessment process, covering all company risks. As part of this process, appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We conduct regular internal reviews of our cybersecurity program which are overseen by our executive management, and material issues are presented to the Board of Directors. Our cybersecurity department also participates as part of our regular quarterly Disclosure Committee to review risks requiring disclosures in financial reporting.


text: Our processes also address oversight and identification of cybersecurity threat risks from our use of third-party service providers, including those in our supply chain. This involves, among other things, conducting pre-engagement risk-based diligence and ongoing monitoring as needed. We also engage third-party service providers from time to time to assist in risk assessment and implementation of monitoring tools, and we review our cybersecurity controls with auditors.


text: Our business strategy, results of operations, and financial condition have not been materially affected by cybersecurity risks, threats, or incidents in the past, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. We continue to invest in the cybersecurity and resiliency of systems and products and continue to enhance our internal controls and processes, which are designed to help protect our systems, products, and the information they contain. Nevertheless, we cannot guarantee that we will not be materially affected in the future by such risks or experience future material incidents.


text: The Audit Committee of our Board ("Audit Committee") is responsible for the oversight of cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats, and incidents. Multiple times per year, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes, covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials, including a cybersecurity scorecard and other materials, indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Vice President of IT, who is responsible for cybersecurity. Members of the Audit Committee also regularly engage in ad hoc conversations with management on cybersecurity-related matters and news events and discuss any updates to our cybersecurity risk management and strategy programs. When incidents occur, depending on the nature and severity, the Audit Committee Chair is notified immediately, and incidents are further reviewed periodically with the Audit Committee. Material cybersecurity matters are also periodically reviewed with the full Board of Directors.


text: As a regular part of our ordinary business operations, we collect and store data, including information necessary for our operations, information from our customers, employees, and our business partners. We recognize these networks and systems may be subject to increasing and continually evolving cybersecurity risks. Our Board is responsible for overseeing risk management. Our Board understands the critical nature of managing risks associated with cybersecurity threats, and, accordingly, cybersecurity is an integral part of the Company's overall risk management program. The Board's Audit Committee has primary responsibility for overseeing cybersecurity and privacy risks. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: Boxlight Corp

ticker: BOXL


text: As part of our risk management processes, we are developing risk assessments to identify the probability, immediacy, and potential magnitude of information security risks. Our internal experts, which are overseen by the Chief Operating Officer, regularly conduct audits and tests of our information systems, and our cybersecurity program is periodically assisted by established, independent third-party consultants, who provide assistance through tabletop and other preparedness exercises. These partnerships enable us to leverage specialized knowledge and insights, seeking to continue to improve upon our cybersecurity strategies and processes. Additionally, we review regular publications on cyber awareness and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies.


text: Based upon the information that we have as of the end of the year covered by this report, we do not believe that we have experienced any material cybersecurity incidents to date. However, the risks from cybersecurity threats and incidents continue to increase, and any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. We have engaged a third-party vendor to provide a variety of cybersecurity services ranging from ongoing security advisory services to cybersecurity monitoring and response management.

companyName: Sphere 3D Corp.

ticker: ANY


text: We use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. For third parties that we rely upon for certain IT systems, we seek to use only reputable providers, to use the most recently reliable versions of such systems, and monitor and address alerts for potential vulnerabilities to any such systems. We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our Chief Executive Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents and reporting any such incidents to our Board of Directors, and periodically briefs our Board of Directors on our cybersecurity and information security posture and on any cybersecurity incidents deemed to have a moderate or higher business impact. In the event of a material cybersecurity incident, our cybersecurity consultant has extensive information technology and program management experience. We believe that we have implemented a governance structure and processes that are equipped to assess, identify, manage and report cybersecurity risks. Refer to "Item 1A. Risk Factors" for a discussion of certain of the cybersecurity risks that our business is subject to. As a smaller reporting company, with respect to compliance with Form 8-K incident disclosure requirements, we were required to comply with the reporting requirements beginning June 15, 2024.


text: Management and Board Oversight In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems are important to our operations and business strategy. The Audit Committee, which is composed solely of independent directors, has been designated by our Board to review and discuss with management the Company's risk assessment and risk management policies, including the steps that management has taken to monitor and control related cybersecurity risks and exposures. Management updates the Audit Committee and the Board as necessary about significant cybersecurity occurrences and measures the Company is taking to prevent the same.

companyName: ALT5 Sigma Corp

ticker: ALTS


text: Risk Management and Strategy We rely on our subsidiary-level information technology professionals to continuously monitor and update our IT networks and infrastructure. Their role is to prevent, detect, address, and mitigate risks related to unauthorized access, misuse, malware, and other security threats. To safeguard our data and business processes, as well as those of our subsidiaries, we invest in industry-standard security technologies to defend against cyber risks.


text: To further strengthen our cybersecurity efforts, with our subsidiary's assistance, we are establishing an "IT Steering Committee" composed of IT professionals from our subsidiary. This committee will meet quarterly to discuss cybersecurity threats, emerging attack methods, and best practices.


text: In fiscal year 2024, our crypto-processing subsidiary engaged an external consultant to conduct a cybersecurity risk assessment of our business operations. This assessment examined both internal and external threats to our systems and data handling processes, providing a structured framework for evaluating, prioritizing, and enhancing our cybersecurity initiatives. On a going-forward basis, in collaboration with our Audit Committee, management will determine and implement appropriate measures based on these findings.


text: As part of our cybersecurity risk management program, we are working with our crypto-processing subsidiary to develop a cyber training curriculum for our employees. The training may cover topics such as phishing awareness, cybersecurity best practices, and e-mail security.


text: Despite our commitment to cybersecurity, no system can fully eliminate technology risks. As of now, we are unaware of any cybersecurity incidents that have had, or are reasonably likely to have, a material impact on our business or operations. However, the increasing volume and sophistication of cyberattacks—including data breaches, ransomware, and similar threats—pose ongoing risks. Incidents that occur could result in reputational, competitive, operational, or financial harm, as well as regulatory consequences. For a more detailed discussion of how cybersecurity threats may affect our business strategy, operations, or financial condition, see Item 1A, "Risk Factors," which is incorporated by reference into Item 1C.


text: Risk Management and Strategy We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, if necessary, we would re-design and implement reasonable additional safeguards to minimize identified risks and address any identified gaps in existing safeguards.


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our third-party IT service provider who reports to our Chief Technology Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and we train our relevant employees on these safeguards, in collaboration with our third-party IT provider and management. Since users are typically the weakest link in any information system, we periodically train all our employees on good cybersecurity practices, including password management, phishing prevention, and other security awareness issues. We have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition.


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure including cybersecurity risk, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: Our Chief Technology Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from our third-party IT service provider.


text: Cybersecurity Risk Management and Strategy We maintain a number of processes to identify and respond to cybersecurity threats and incidents including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercise, and recovery and resilience tests. Our information security and third-party risk management programs evaluate cybersecurity threats posed by internal and external factors and support daily operational functions that prevent unauthorized access or compromise.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: The third-party risk management programs report functionally to our overall risk management function, led by our Chief Risk Officer. The information security program, led by our Chief Information Security Officer and our Chief Information Officer, evaluates internal and external cybersecurity threat factors according to a written policy statement approved by the Board periodically. We maintain processes to evaluate third parties whose information systems support our critical operations.


text: The third-party risk management program evaluates cybersecurity risks and information systems of third parties at onboarding and on an ongoing basis. Processes include evaluating reports and/or performing assessments of a third party's information systems leveraging cybersecurity frameworks such as International Organization for Standardization (ISO) ISO 27001, Cybersecurity Framework (CSF) published by the US National Institute of Standards and Technology, as well as evaluating reports issued by a third party's auditors developed under the attestation standards issued by the American Institute of Certified Public Accountants (AICPA). We integrate risk mitigation into additional onboarding requirements to address identified risk factors, such as developing service level agreements and minimum required information security performance expectations to enable cybersecurity threats and incidents to be managed within applicable industry or regulatory standards. We require contracts of third parties to incorporate industry and regulatory standard clauses requiring reporting to us of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.

stage1Category: Third-Party Risk


text: The information security program performs periodic risk assessments of our information systems and cybersecurity threats using industry standard methodologies based on FFIEC Cybersecurity Assessment Tool (CAT), as well as regulatory guidance issued by the Federal Financial Institutions Examination Council (FFIEC) and state and federal regulators, including the Federal Deposit Insurance Corporation and the Michigan Department of Insurance and Financial Services. Based on risk, our information security program performs internal engagements to provide assurance to senior management and the Board that our information systems are able to identify, escalate and mitigate cybersecurity threats on a routine basis. We also engage external independent parties to perform independent audit engagements, as well as other assessments of our information security and third-party risk management program and information systems.


text: We are exposed to cybersecurity threats and incidents that can range from uncoordinated individual attempts to gain unauthorized access to information systems to sophisticated and targeted measures known as advanced persistent threats, directed at the Company or its third-party service providers. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the two-year period ended December 31, 2024. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory scrutiny or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations. We evaluate the risks of data theft (including theft of sensitive, proprietary and other data categories, in addition to personal data), and harm to customer or third-party relationships or the possibility of litigation or regulatory investigation or actions that could materially adversely affect our results of operations and our reputation. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Cybersecurity Governance An Information Technology Steering Committee was established to assist Management and the Board of Directors in the oversight and risk management of information security. This Committee is responsible for updates which summarize cybersecurity threats and incident monitoring activity, along with details of remediation to address threats and incidents. The summary considers both internal as well as external threat events and outlines management's approach to enable the timely identification and notice of a material incident, should one occur, without unreasonable delay.


text: The Board of Directors receives periodic training related to cyber security and is responsible for approval and oversight of management's policies governing information system security and cybersecurity threats and incidents, as well as oversight of management's approach to secure our information systems. The Board of Directors delegates the primary oversight of risk management to the Bank's Audit Committee.


text: The Audit Committee receives, and reviews reports on our risk management processes, which include assessments of management's cybersecurity threats and incident management functions. The committee receives periodic reporting of certain cybersecurity risks from the Chief Information Security Officer, including reports related to social engineering, effectiveness of cyber security training, as well as vulnerability and penetration assessments performed on the Company's information systems by internal and by external parties and audit reports of information systems and cybersecurity threat and incident monitoring.


text: P otential cybersecurity incidents are reviewed by the Chief Information Security Officer and the Information Technology Steering Committee. The evaluation of reported events by the committee includes reporting of any mitigation or remediation determined necessary to address the threat posed by the reported event. If any event rose to the level of a material incident, management maintains an incident response plan to mitigate the impact, maintain business continuity and provide for internal and external communication, including required notifications.


text: Our Chief Information Security Officer has over 25 years of relevant experience and formal training in the areas of cybersecurity, risk management, and data privacy in the financial services industry. The Chief Information Security Officer holds a Master of Science in Computer Information Systems and appropriate professional certifications. Our Chief Information Officer has over 20 years of executive level technology leadership experience in the financial services industry.


text: Cybersecurity Risk Management We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: Our cybersecurity risk management program is an integral component of our overall information security platform sharing common governance processes that monitor, prevent, detect, mitigate, and remediate cybersecurity incidents and guiding continuous improvement to our broader enterprise IT infrastructure.


text: In support of our cybersecurity risk management program, we have adopted an Information Security Policy and Incident Response Plan. The Information Security Policy and Incident Response Plan establishes a comprehensive guide of controls and operating procedures to enable internal and external teams to prepare, detect, contain, and recover from cybersecurity incidents. Our cybersecurity risk management program also includes: • Cybersecurity risk assessments to evaluate our readiness if certain risks were to materialize; • Individuals, including management, employees, and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • The use of external service providers and tools, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response planning and testing, and management; and • Third-party risk management processes for service providers, suppliers, and vendors.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurance that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors—Risks Related to Our Business" of this Annual Report for more information regarding the cybersecurity risks we face.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: In addition, our management team, comprised of senior staff and executives from multiple departments within the Company, including IT, finance, legal, and operations, leads all efforts for our overall cybersecurity risk management program and supervises both our internal information security personnel with prior work experience in cybersecurity and our retained cybersecurity consultants.


text: The Company recognizes the increasing complexity and significance of cybersecurity risks in safeguarding its technology, operations, and customer data. As an advanced electric vehicle manufacturer, the Company's operations rely on interconnected digital infrastructure, cloud-based systems, and proprietary software platforms, making cybersecurity an essential component of its risk management framework.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: The Company has implemented a comprehensive cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks. This approach is informed by industry best practices, including the NIST Cybersecurity Framework ("CSF") and Risk Management Framework ("RMF"). The program is designed to prevent disruptions to operations, protect critical assets, and ensure compliance with applicable regulations such as the California Consumer Privacy Act ("CCPA"), the General Data Protection Regulation ("GDPR"), and the Securities and Exchange Commission ("SEC") cybersecurity disclosure requirements.


text: The following disclosure outlines the Company's cybersecurity risk management strategy, governance structure, incident response procedures, regulatory compliance efforts, and ongoing investments in cybersecurity.


text: 1. Cybersecurity Risk Management The Company employs a structured cybersecurity risk management program that aligns with NIST CSF's five core functions: Identify, Protect, Detect, Respond, and Recover. The approach includes: • Risk Assessments: Regular evaluations of cyber risks across IT infrastructure, production systems, and cloud-based platforms. • Threat Detection and Monitoring: Deployment of Security Information and Event Management (SIEM) tools, intrusion detection systems, and endpoint security solutions to monitor cyber threats in real-time. • Third-Party Risk Management: Continuous evaluation of vendors and partners who have access to the Company's sensitive data and operational networks. • Access Controls and Encryption: Implementation of multi-factor authentication (MFA), data encryption protocols, and network segmentation to reduce attack vectors.


text: The Company integrates cybersecurity into its enterprise risk management (ERM) framework to ensure cyber threats are regularly evaluated as part of its business strategy and operational resilience efforts.


text: 2. Governance and Oversight Cybersecurity oversight is a shared responsibility between the Company's Board of Directors, senior management, and IT security leadership. The Board receives regular updates on cybersecurity risk exposure, incident response capabilities, and compliance efforts from management.


text: The Company's Senior Cybersecurity Engineer leads the execution of cybersecurity programs, including: • Developing and maintaining security policies. • Conducting periodic risk assessments and audits. • Managing incident response and recovery plans. • Providing reports to senior executives on security trends, vulnerabilities, and ongoing mitigation efforts.


text: The Company enforces a top-down approach to cybersecurity governance, ensuring accountability and continuous risk monitoring at all levels of the organization.


text: 3. Management's Role in Cybersecurity Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements. The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company's security posture.


text: Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture. All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.


text: 4. Cybersecurity Strategy and Resilience The Company has established robust cybersecurity resilience measures to ensure that cyber incidents do not materially impact operations. These include: • Backup and Redundancy: Critical business systems are backed up and replicated to prevent data loss and operational disruptions. • Incident Containment and Recovery: Automated security responses, real-time malware detection, and forensic analysis capabilities enable the Company to respond swiftly to threats. • Proactive Threat Intelligence: Continuous monitoring of emerging cyber threats and industry trends, allowing for adjustments to the security strategy.


text: The goal is to maintain business continuity, protect proprietary technology, and safeguard customer and employee data in the event of a cyber incident.


text: 5. Material Cybersecurity Incidents During the reporting period, the Company experienced a cybersecurity incident related to employee interactions with suspicious websites. The incident was promptly contained, and a forensic investigation confirmed that no material impact occurred to operations, financial position, or customer data.

stage1Category: Incident Disclosure


text: 6. Impact of Cyber Incidents Cybersecurity incidents, if material, could affect the Company's financial condition, operational stability, and reputation. Risks include: • Direct financial losses from remediation costs, potential ransomware payments, or legal expenses. • Operational disruptions affecting vehicle production and supply chain logistics. • Regulatory fines and penalties for non-compliance with data protection laws. Reputational damage impacting customer trust and investor confidence.


text: The Company regularly assesses its financial exposure to cybersecurity risks and has contingency plans in place to mitigate these impacts.


text: 7. Board Expertise in Cybersecurity N o Board members currently hold formal cybersecurity certifications or direct experience in cybersecurity risk management. The Company continues to enhance Board education on cybersecurity trends and governance practices.


text: Third-Party Risk Management: We assess the cybersecurity practices of our third-party vendors and service providers, including conducting due diligence on vendors before engaging their services and monitoring their compliance with our security requirements.

companyName: BlueOne Card, Inc.

ticker: BCRD


text: Failure to comply with cybersecurity regulations could result in financial penalties, legal liabilities, and reputational harm. The Company conducts regular compliance reviews to ensure alignment with evolving regulatory requirements. •24/7 monitoring for cybersecurity threats. • Real-time threat detection and forensic investigation tools. • Collaboration with third-party security firms for penetration testing. This plan ensures that cyber threats are identified, contained, and mitigated efficiently.


text: 11. Cyber Insurance and Risk Transfer The Company maintains cyber insurance coverage to mitigate financial risks associated with cybersecurity incidents. This insurance covers: • Incident response and recovery costs. • Legal fees and regulatory penalties. • Business interruption expenses. The risk management team regularly evaluates the adequacy of coverage based on evolving cyber threats. 12. Historical Cyber Incidents No material cybersecurity incidents were recorded in prior reporting periods.


text: Risk Management and Strategy Our generating facilities are part of the United States' energy infrastructure system and we face a myriad of cybersecurity threats. As such, cybersecurity is an area of continuous focus and we maintain a comprehensive cybersecurity risk management program with processes in place to assess, identify and manage cybersecurity risks. Our management and oversight of direct and indirect cybersecurity risks and our response to any cybersecurity incident is an integral part of our business.

companyName: OGLETHORPE POWER CORP


text: We have a long-standing focus on cybersecurity risks and compliance with applicable safety protocols. Our primary cybersecurity focus areas are plant infrastructure, data privacy, and outsourced services. Within these areas, we maintain multi-faceted, layered security programs designed to protect and preserve the confidentiality, integrity and availability of data and systems. Within our organization, we have a mature information technology security program and cybersecurity responsibilities are clearly defined. We regularly invest in technology and information system upgrades designed to prevent, detect and respond to attacks. We also perform tabletop exercises for executive leadership.


text: We require all employees to complete quarterly cybersecurity-related training and awareness programs. We review the cybersecurity practices of our vendors who provide goods and/or services that could impact our plant control systems and require contractors with access to our plant control rooms to complete annual cybersecurity-related training. We also require enhanced diligence reviews on all contractors and employees who have access to our plant control systems.


text: As part of the nation's critical infrastructure network, we are subject to certain mandatory reliability standards, which include cybersecurity requirements. We have a formal compliance program to establish, monitor and maintain compliance that includes comprehensive cybersecurity elements designed to protect and preserve our critical information and energy infrastructure systems. We reference industry and government frameworks and best practices to continuously improve our cybersecurity program and we participate in industry groups and information sharing exchanges to understand emerging cybersecurity trends and threats.


text: Georgia Transmission and Georgia System Operations provide us with certain transmission and system operations services that enable us to deliver energy to our members. As part of our risk management approach, we coordinate our cybersecurity preparedness and response planning with Georgia Transmission and Georgia System Operations.


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity to assess and enhance the effectiveness of our security programs. From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support and audit our cybersecurity preparedness. We have also adopted cybersecurity incident response guidelines. As required by these guidelines, teams and plans are in place to respond to any cybersecurity incident, including internal and external communication responsibilities.


text: As of the date of this annual report, we have not experienced any cybersecurity incident that has materially affected our business. See "RISK FACTORS" for a discussion of cybersecurity risks that may affect us.


text: Our board of directors, along with the audit committee of our board of directors, is responsible for oversight of our cybersecurity risks and receives regular reports regarding our assessment and management of cybersecurity risks and information regarding any significant cybersecurity incidents.


text: Our board has adopted a policy regarding cybersecurity and delegated administration of the policy to our President and Chief Executive Officer.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Third parties might attempt to gain unauthorized access to our network or seek to compromise our products and services."


text: Compliance and Reporting: We comply with all applicable laws and regulations related to cybersecurity, including data protection and privacy laws.


text: Currently, our risk management and compliance committee, comprised of our chief executive officer, chief operating officer, chief financial officer, and the executive vice president of member and external relations, assesses and monitors material risks from cybersecurity threats. Members of our risk management and compliance committee receive regular updates regarding the prevention, mitigation, and detection of cybersecurity incidents and would oversee the response and remediation of any material cybersecurity incident. Our risk management and compliance committee also ensures our board of directors is briefed on cybersecurity risks, makes materiality determinations with regards to cybersecurity risks and monitors the active management of cybersecurity risks by internal and external teams. For additional information regarding our board of directors' risk oversight activities, see "DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE – Board of Directors' Role in Risk Oversight."


text: We have established procedures for evaluating, recognizing, and handling significant risks stemming from potential unauthorized events occurring on or through our electronic information systems, which could negatively impact the confidentiality, integrity, or accessibility of our information systems or the data stored within them. These procedures encompass a diverse range of mechanisms, controls, technologies, systems, and other processes aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. This data comprises confidential, business, and personal information that we gather, process, store, and transmit as part of our operations, including on behalf of third parties. Furthermore, we utilize systems and procedures intended to minimize the repercussions of a security incident involving a third-party vendor or customer. Additionally, we employ procedures to supervise and identify significant risks arising from cybersecurity threats linked to our utilization of third-party technology and systems, such as encryption and authentication systems, employee email services, back-office support systems, and other operational functions.

companyName: Intellicheck, Inc.

ticker: IDN


text: We adhere to a risk management framework based on applicable laws and regulations, incorporating industry standards and recognized practices to handle cybersecurity risks across our products, services, infrastructure and corporate assets. To evaluate and address cybersecurity threats, we analyze factors such as threat intelligence, first- and third-party vulnerabilities, changing regulatory requirements and observed incidents. We regularly conduct risk assessments to gauge the effectiveness and maturity of our systems, identifying areas for improvement. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. We also maintain a privacy risk management program to assess risks related to user data collection, with an independent third-party privacy assessor to ensure compliance. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions, alongside annual cybersecurity and privacy training for all staff members.


text: Our cybersecurity risks and associated mitigations are evaluated by our IT team, including our VP of Technology Operations and Information Security, as part of our enterprise risk assessments that are reviewed by our management team. Our VP of Technology Operations and Information Security serves as the Company's designated Chief Information Security Officer and is responsible for developing and implementing the cybersecurity risk management program, including reporting on cybersecurity matters to the Board of Directors. The VP of Technology Operations and Information Security has more than 19 years of experience leading cybersecurity oversight.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, which include: internal briefings from relevant personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity consultants; and alerts and reports produced by security tools deployed in our IT environment. In addition, the Board of Directors oversees the Company's cybersecurity risk exposures and the steps taken by management and the Chief Information Security Officer to monitor and mitigate cybersecurity risks. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: BKV employs a comprehensive cybersecurity strategy to protect against threats that could compromise sensitive information, disrupt data or systems, or jeopardize the security of facilities and infrastructure, including third-party processing plants and pipelines.

companyName: BKV Corp

ticker: BKV


text: Managing Material Risks & Integrated Overall Risk Management BKV has strategically integrated cybersecurity risk management into its broader enterprise risk management framework to promote a company-wide culture of cyber risk awareness. BKV's Chief Information Officer ("CIO") and Manager of Cybersecurity work closely with its information technology ("IT") department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the Center for Internet Security (CIS) Critical Security Controls and National Institute of Standards and Technology (NIST) frameworks.


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining and regularly updating a defined and practiced incident response plan ("IRP"); • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection software, such as antivirus, anti-malware, firewall, endpoint detection, and identity and access management; • Executing scheduled, recurring server and infrastructure patching processes; • Maintaining a defined disaster recovery policy and employing backup/disaster recovery software, where appropriate; • Educating, training, and testing employees on information security practices and identification of potential cybersecurity risks and threats; and • Ensuring familiarity and compliance with cybersecurity frameworks where appropriate.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, BKV engages with external experts, including, but not limited to a managed security service provider ("MSSP"), the Cybersecurity Operations Center ("CSOC") team to evaluate, monitor, and test BKV's cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, IRP testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements. Third-party experts have assisted BKV in conducting cross-functional tabletop exercises and quarterly strategic meetings as well as developing comprehensive remediation plans following cybersecurity assessments.


text: Managing Third Party Risk BKV's cybersecurity approach also assesses the risks associated with the use of vendors, service providers, and other third parties that provide information system services, process information on its behalf, or have access to its information systems, and has processes in place to oversee and manage these risks. In addition to the minimum security and control standards, these processes include other quality control measures as well. BKV also maintains ongoing monitoring to support continuous compliance with its cybersecurity standards, and regularly updates and patches third-party applications and tools when vulnerabilities are discovered.


text: Risks from Cybersecurity Incidents As of March 31, 2025, BKV has not been subject to any material cybersecurity incidents and we are not aware of any cybersecurity risks that are reasonably likely to materially affect the Company, its operations, or financial standing. For additional information about cybersecurity risks associated with our business, see Item 1A, " Risk Factors."


text: Risk Management Personnel We have an enterprise risk committee that includes our executive leadership team and other senior members within our legal, IT, finance and accounting, and operational departments, which oversees BKV's operational, strategic, and corporate-level risks, including risk management.


text: Our comprehensive cybersecurity risk management is led by our CIO who brings over 30 years of extensive experience in information technology with a specialization in cybersecurity. Her expertise spans global information systems and data, cybersecurity operations, security management strategies and tools, security assessment and remediation, as well as the design and implementation of controls to prevent and detect cybersecurity threats. BKV's cybersecurity risk management program is overseen by management at multiple levels. The CIO and Manager of Cybersecurity play key roles in assessing, monitoring, and managing the Company's cybersecurity risks. The CIO Cybersecurity governance also is supported by our IT department and CSOC. These stakeholders meet monthly to review the monthly cybersecurity assessment and remediation report. The IT department conducts extensive reviews of our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities and implements systems and tools to remediate perceived risks. These tools are designed to prevent and detect activities or events that could pose a cybersecurity risk to our business. Our third party CSOC team provides 24-hour monitoring to detect and respond to suspicious activity in real time.


text: Monitor Cybersecurity Incidents The CIO and Manager of Cybersecurity are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the 24/7/365 monitoring of our information systems as well as ongoing threat assessment monitoring. The deployment of advanced security measures, regular system audits to identify potential vulnerabilities, and periodic cyber assessment exercises support these programmatic efforts. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced IRP. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board of Director Oversight Our Audit & Risk Committee provides oversight of cybersecurity risk in connection with BKV's comprehensive cybersecurity strategy and receives regular quarterly updates on our ongoing assessment of cybersecurity risks, threats, and data security programs to prevent and detect breaches and attacks against BKV. The CIO and other experts, as necessary, provide the Audit & Risks Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers The Audit & Risk Committee meets quarterly to discuss areas that are potentially high risk to the Company.


text: The program includes a well-defined risk assessment and analysis process, identifying critical digital assets, conducting thorough threat and vulnerability assessments, and quantifying risks based on potential impact and likelihood. This information prioritizes risks, allowing us to allocate resources effectively and focus on mitigating the most significant threats. Policies and procedures form the foundation of the cyber risk management program, with comprehensive guidelines covering data protection, access controls, incident response, and employee training. Security controls, such as robust identity governance and access controls, AI-based email security solutions, endpoint protection, and network security measures, are implemented to fortify our defenses. An effective incident response plan ensures a swift and coordinated response to security incidents, minimizing potential damages. Continuous monitoring through MDR (Managed Detect and Respond) solutions and staying informed about the latest threat intelligence feeds enhance our ability to detect and respond to evolving cyber threats.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: As part of our cybersecurity program, we assess the cybersecurity posture of our third-party vendors and partners to ensure they meet our security standards. This includes due diligence during the vendor selection and periodic evaluations throughout our partnerships. Third-party risk management, compliance adherence, and the consideration of cyber insurance contribute to a holistic and proactive approach to cyber risk management. Regular reviews and updates to the program ensure its relevance and effectiveness in the face of emerging threats, fostering a culture of continuous improvement and resilience.


text: We have not identified any risks from cybersecurity threats, including any that resulted from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our cybersecurity program encompasses a comprehensive framework that begins with a clear governance structure lead by our Chief Technical Officer (CTO). Our CTO has spent over twenty-five years in the technology industry specializing in information security, cloud transformation, business intelligence and infrastructure. His cybersecurity experience includes having founded and managed a technology security and infrastructure consulting business catering to Fortune 500 companies.


text: Our CTO provides our Board of Directors with quarterly reports on cybersecurity risks and any material cybersecurity incidents. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity program and other cybersecurity developments. Regular reporting mechanisms to our Board of Directors and senior management keep all stakeholders informed about the evolving cyber risk landscape and the program's effectiveness.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We measure our cybersecurity infrastructure against the NIST 800-171 framework and routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct regular technical risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We also conduct periodic programmatic risk assessments including identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; evaluate how to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and annual policy acknowledgments.


text: We engage external cyber vendor consultants, auditors, and other third parties in connection with our risk assessment processes. These service providers assist us to assess, design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We review the ability of third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our Company.


text: In accordance with our cybersecurity incident response plan ("IRP), our Chief Information Officer, members of our management team, including personnel representative of the following functions – legal, IT, finance, audit, operations, engineering, human resources, communications, and additional executives as applicable under the plan – and external cybersecurity support providers (collectively, "IRP stakeholders"), are primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Chief Information Officer and our IRP stakeholders oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Information Officer has an advanced degree in management information systems and has managed the Company's IT processes and policies inclusive of cybersecurity matters throughout his tenure at the Company, in addition to many years of prior experience in various technology roles at a large U.S. public company. He is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by working with the IT department and external vendors to implement our security risk management, including through the use of both automated and manual tools and reporting, in accordance with the Company's incident response plan and Company cybersecurity policies.


text: Our Chief Information Officer provides quarterly briefings to the audit committee and board of directors regarding our Company's cybersecurity program, including risks and activities, reports of recent cybersecurity incidents and related responses (if any, and if not previously reported to the Board pursuant to the incident response plan), cybersecurity systems testing, the status of third party assessments, general updates in the cybersecurity space, relevant disclosures related to SEC reporting, and the like.


text: Cybersecurity is an important part of our risk management program for our Board and management. The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through directory-based identity-related services for operation account security, firewall policies and periodical vulnerability threat scanning for network security and email-layer and endpoint-layer protections for data integrity on systems and user devices.

companyName: FGI Industries Ltd.

ticker: FGI


text: The Company's Director of IT is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our Director of IT has over 15 years of experience in information security positions and holds Master's degree in computer information systems. We also have constituted a cross-functional Cybersecurity Committee, comprised of the Director of IT, along with the Chairman, CFO, Management of Business Operations and Human Resources, which meets regularly to review enterprise-wide cybersecurity matters.


text: Our Board of Directors oversees management's approach to managing cybersecurity risks. The Board of Directors is charged with overseeing the Company's risk management program, which includes cybersecurity matters. The Board of Directors routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments and policies and practices and receives updates on technology trends and regulatory developments from the Director of IT periodically.


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats, derived from the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, access control, and employee training. Risks identified by the Director of IT and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The Director of IT also routinely discusses trends in cyber risks and our strategy with our Cybersecurity Committee and management on a regular basis, in addition to an annual review and discussion with the full board.


text: In addition, we endeavor to apprise employees of emerging risks and require them to undergo bi-annual security awareness trainings and supplemental trainings as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards. We engage certain third parties to enhance and assist with our cybersecurity oversight, including a 24/7 Security Operation Center, or SOC, that monitors network devices and computer systems in real time. We include confidentiality and data protection provisions in certain contracts with third-party service providers to help protect us and our patients from any related vulnerabilities.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: We do not believe that there are currently any known risks from cybersecurity threats that have or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information on the most pertinent risks we may experience from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" – "Our internal computer systems, or those of our collaborators, vendors, suppliers, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs."


text: Cybersecurity Governance and Oversight The audit committee of our board of directors provides oversight over cybersecurity risk and updates the full board of directors periodically regarding such oversight. The audit committee reviews and discusses with management the Company's major risk exposures, including cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents, if any.


text: Our Chief Executive Officer, or CEO, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The consultant that operates our SOC updates the CEO regarding the detection of cybersecurity risk exposure and provides advice on the prevention, mitigation and remediation of such risks. The CEO keeps the senior executive leadership team apprised, including our Vice President of Finance, on assessments of risk exposure to ensure that the highest levels of management are kept abreast of potential risks we are facing. The CEO has significant prior business experience in compliance and risk management and coordinates directly with the third party who operates our SOC on issues involving particular cybersecurity expertise.


text: In an effort to help deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection cybersecurity and incident prevention training throughout the year, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Cybersecurity Strategy, Policy and Procedures We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined within Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We utilize information technology ("IT") that enables our teams to access both operational and financial performance data in real time, while at the same time, helping to identify and prevent cybersecurity threats and risks.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU