text: Key to the Audit Committee's role is its periodic engagement with our cybersecurity team, as further described below, which provides direct communication and alignment on cybersecurity matters between members of our board and management. During these critical meetings, several pivotal areas are reviewed to assess the adequacy and effectiveness of our cybersecurity measures: • Incident Response: Evaluation of our readiness and response strategies to potential cybersecurity incidents. • Cybersecurity Industry Updates: Review of recent industry developments (i.e., new threats/tactics, industry news) to focus on compliance and adaptation of our strategies accordingly. • Acquisition Security Integration: Discussion on the security aspects of recent or upcoming acquisitions, focusing on the integration of their cybersecurity frameworks into our broader security posture. • Employee Security Awareness and Training: Information regarding our regular testing and training of employees is presented and discussed. • Penetration Test Results: Analysis of our regular penetration testing exercises, which help identify vulnerabilities and strengthen our defenses. • Questions and Answers: An open forum for the Audit Committee to seek clarifications and provide guidance on cybersecurity matters, fostering a culture of transparency and continuous improvement.


text: This structured approach to governance and oversight, with an emphasis on receiving feedback allows us to align across the Alta organization. By prioritizing the identification and management of cybersecurity risks, we aim to safeguard our assets and maintain the continuity of our business operations in the face of evolving cyber threats.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: Our Senior Director of IT and Director of Security and Compliance have primary responsibility for assessing and managing cybersecurity risks. An internal team of cybersecurity professionals execute our cybersecurity program while our VP of Information Services provides executive oversight. Combined, our experts bring multiple decades of cybersecurity experience and have earned cybersecurity-related certifications. Our internal team is bolstered by strategic third-party security partners leveraged to provide 24x7 monitoring and response. Third parties routinely assess our security practices providing tactical assistance or strategic guidance through audits and penetration tests. All members of the team routinely discuss emerging security threats and ways to mitigate risk.

stage1Category: Management Role

stage1Method: unanimous


text: We utilize an in-depth layered approach to security. This allows us to respond and mitigate cybersecurity risks, underscoring our commitment to the confidentiality, integrity, and availability of our data and systems. The Company has processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. Our strategy includes the deployment of advanced security products and penetration testing to identify and mitigate vulnerabilities by continuous vulnerability scanning and monitoring by both internal and external teams. This approach is bolstered by backup and recovery protocols, including data resilience, email security measures and endpoint detection and response systems to thwart malicious activities.


text: Additionally, our commitment to security is evident in our security awareness training for all employees, dark web monitoring, and 24x7 threat monitoring.


text: Our incident response plan is designed to address security incidents effectively, supported by stringent information security policies and the implementation of a security information and event manager system for real-time analysis and reporting of security events and incidents. As part of our security commitment, we undergo penetration testing to assess whether our necessary security controls are maintained.


text: The Company faces risks from cybersecurity threats that could potentially have an adverse effect on our business, financial condition, results of operations, cash flows and reputation. Although such risks have no t materially affected our business, to date, we have experienced various immaterial threats to our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Security breaches and other disruptions in the Company's IT systems, including the Company's ERP system, could limit the Company's capacity to effectively monitor and control our operations, compromise ours or our employees', customers' and suppliers' confidential information, or otherwise adversely affect the Company's operating results or business reputation" in Item 1A. Risk Factors.

stage1Category: None/Other


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cybersecurity threats. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity program component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Risk Committee of our board of directors.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: The program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF framework provides the basis to evaluate our program for completeness and helps to ensure that the various components of the program are at a level that reduces cybersecurity risk to levels within the Company's risk appetite, considering the current threat and regulatory environment. Key components of the cybersecurity program include: • A risk assessment process that identifies and prioritizes cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the board of directors. • A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • An incident response plan that outlines establishes a structured approach for the Company's response to a cybersecurity incident. The incident response plan is coordinated through the CISO and key members of management are embedded into the plan by its design. The plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. • A training program that educates employees about cybersecurity risks and how to identify and escalate cybersecurity events. • A third-party risk management program designed to ensure that our key vendors meet our expectations on cybersecurity. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendors' compliance with our cybersecurity requirements.


text: The Company engages reputable third parties to conduct various risk assessments on a regular basis, including but not limited to maturity assessments and various security system testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe, and we may not be successful in preventing or mitigating all cybersecurity incidents that could have a material adverse effect on the Company. However, as of the date of this Form 10-K, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Board of Directors Oversight The Risk Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Risk Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews quarterly reports regarding the information security program and technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.


text: Management Oversight Our CISO is accountable for managing our enterprise information security department and overseeing our information security program. The CISO reports directly to the Chief Risk Officer. The CISO's responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to senior leadership and the Risk Committee and/or Board in a timely manner. The CISO has over 20 years of experience in cybersecurity across the U.S Government, Department of Defense contracting, and financial services industry. Prior to joining the Company, the CISO served as the Deputy CISO for a major domestic financial services institution.


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our Board of Directors is actively involved in oversight of our Company's risk management, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the Committee of Sponsoring Organizations of the Treadway Commission 2013 Framework. In general, our Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.

companyName: STORE CAPITAL LLC


text: Risk Management and Strategy As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:


text: Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. Further, we perform ongoing phishing simulations to help employees recognize, avoid and report potential threats that could compromise critical business data and systems. Additional mandatory training is provided to employees who engage in potentially compromising activities during these simulations.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We may engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to those charged with governance by our Senior Vice President of Information Technology, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these activities.


text: Our Board of Directors oversees our risk management approach, including the management of risks arising from cybersecurity threats. Our Board of Directors receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Board of Directors also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, our Board of Directors discusses our Company's approach to cybersecurity risk management with management.


text: Our Board of Directors, in connection with management led by our Senior Vice President of Information Technology, work collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout our Company are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Board of Directors monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.


text: Our Senior Vice President of Information Technology has served in his role since January of 2020 and has managed STORE's Information Technology department since joining the Company in January of 2015. In these roles, he has been instrumental in the evolution and implementation of our business systems and technical infrastructure as well as the development and enforcement of Sarbanes-Oxley (SOX) compliance processes and reporting. Prior to joining STORE, he was the Chief Information Officer for Southwest Network, a non-profit organization for mental and behavioral health services serving the greater Phoenix, Arizona community. He has over 35 years of experience in the information technology industry serving in several technical and leadership positions.


text: Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats have had or are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition.


text: Our cybersecurity program is designed to protect our information systems and information against cybersecurity threats that may impact the confidentiality, integrity and availability of our information systems and information. Our program includes policies, processes and technologies to assess, identify and manage risks from cybersecurity threats and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: LandBridge Co LLC

ticker: LB


text: Our board of directors, in coordination with the Audit Committee, oversees the Company's processes for assessing and managing risk. Our board of directors has delegated primary responsibility for overseeing our enterprise risk management process, including oversight of information technology, cybersecurity, and data privacy risks, to the Audit Committee. Despite this delegation of primary responsibility, both the Audit Committee and the board of directors are actively involved in risk oversight. The board of directors and Audit Committee regularly review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

stage1Category: Board Governance


text: Depending on the environment and system, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data including, for example: incident response plans and policies; vulnerability management policy; disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls and data segregation for certain systems; access controls; physical security controls; asset management, tracking, and disposal; systems monitoring for certain systems; employee training; penetration testing of certain environments and cybersecurity insurance.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Management is responsible for identifying and assessing cybersecurity risks, establishing processes to ensure that such cybersecurity risk exposures are monitored, implementing proactive mitigation measures and responding in the event of an incident. We seek to identify and mitigate cybersecurity risks through a comprehensive, cross-functional approach. The Cyber Incident Response Team is headed by the Manager's Senior Vice President of Information Technology (the "SVP of IT") and also includes senior representatives from various corporate and operational functions of the Manager. The Manager's SVP of IT possesses deep experience in technology and cybersecurity, gained over a career of over 20 years managing IT functions for organizations, including network infrastructure, cloud administration, application development and cybersecurity. The SVP of IT possesses a degree in Information Systems and regularly attends educational and professional development seminars on cybersecurity trends and threats. She leads our information technology team, which is responsible for managing our internal IT and cybersecurity processes. The Manager's SVP of IT meets quarterly with the Manager's Risk Committee, which is comprised of senior representatives from various corporate functions and other members of our senior management to provide updates on the Company's cyber risks and threats, cybersecurity incidents (if any), the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. We have processes in place to guide our assessment, response and notification procedures upon the occurrence of a cybersecurity incident. Further, we have partnered with a third-party cybersecurity vendor to provide managed security services in order to supplement our internal IT and cybersecurity processes. Depending on the nature and severity of the cybersecurity incident, this process provides for notifying and escalating the incident to our board of directors.


text: Risk Management and Strategy Our business operations rely on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data. Our information and operational technology networks, those of our operators and managers, and those of third parties on whom we rely, are important to our ability to perform day-to-day operations of our business. As a part of our cybersecurity risk management program, we review the various different Company policies that cover cybersecurity on an annual basis and have implemented procedures for responding to cybersecurity incidents. We provide training and awareness programs for all employees of Manager that includes periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls. We have implemented network monitoring, containment and incident response tools, vulnerability management processes and penetration testing. We also actively engage with key vendors and third-party advisors and consultants that assist us with identifying, assessing and managing cybersecurity risks to our business and employ processes to detect and monitor unusual network activity. In connection with our use of third parties, we employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at such vendor or service provider.


text: Material Cybersecurity Risks, Threats and Incidents The oil and gas industry has become increasingly dependent on information technology and operational technology to conduct certain processing activities. At the same time, cybersecurity incidents, including deliberate attacks or unintentional events, have increased. Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents.


text: As detailed elsewhere in this Annual Report, we rely on information technology to manage our business and support our operations, including our secure processing of proprietary and other types of information. Despite ongoing efforts, our systems for protecting against cybersecurity risks may not be sufficient, and a cyber attack or security breach could result in liability under data privacy laws, regulatory penalties, damage to our reputation or loss of confidence in us, or additional costs for remediation and modification or enhancement of our information systems to prevent future occurrences. As of the date of this report, we have not experienced any material cybersecurity incidents and are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. This does not guarantee that future attacks, incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. For additional information on cybersecurity risks we face, see "Risk Factors—Risks Related to Our Business and Operations—Cyber incidents or attacks targeting systems and infrastructure used by the oil and natural gas industry may adversely impact our operations, and a cyber incident or systems failure could result in information theft, data corruption and operational disruption and our results of operations, cash flows or financial position may be adversely impacted."

stage1Category: Strategy Integration


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This means that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is part of our overall risk management program and shares similar governance processes and reporting channels that apply across the risk management program to financial, legal, compliance, and other operational risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our Director of Information Technology works with management to help mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an internal team responsible for, inter alia, managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • artificial intelligence based managed detection and response system that provides 24 7 monitoring of our networks, endpoints, and cloud environments; alerts from this system are handled by an external 24x7 staff that reviews the alerts and acts where necessary; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management evaluation process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors with access to our information systems or data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – "Our internal information systems, or those of any of our CROs, contract manufacturers, service providers, other contractors or consultants or potential future collaborators, may fail or suffer cybersecurity incidents or breaches, which could result in a material disruption of our product development programs."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management is required to update the Committee where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our information technology team, led by our Vice President of Information Technology, is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Vice President of Information Technology reports to our Chief Financial and Business Officer. The Vice President of Information Technology has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. The Vice President of Information Technology has over 25 years of experience in information technology.


text: Our information technology team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal IT environment.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware, software and critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").


text: Our information security function, led by our Director of Information Technology, helps identify, assess and manage the Company's cybersecurity threats and risks. Our Director of Information Technology helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, monitoring provided by a third-party security operations center, deploying manual and third-party service provider automated tools in certain environments, subscribing to reports and services that identify cybersecurity threats (and analyzing such reports), conducting scans of certain environments, evaluating our industry's risk profile and threats reported to us, conducting internal audits and threat assessments for certain threats, conducting vulnerability assessments using third-party tools to identify vulnerabilities, engaging third parties to conduct threat assessments, using external intelligence feeds and monitoring the dark web.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services, forensic investigators and endpoint detection and response vendors.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may utilize various vendor management processes that may include reviews of security assessments or certifications and contractual measures.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of the third parties whom we work with, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: We also have a Corporate Information Security Steering Committee ("CISSC"), which includes several members of senior management, including the Chief Financial Officer ("CFO") and General Counsel. The CISSC oversees corporate information security initiatives and the Company's responses to cybersecurity incidents, and reports to the board of directors on certain of the Company's corporate security programs and investments.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology, Gio Hernandez, who has over 15 years of experience in information security. Mr. Hernandez reports to our CFO, Rodney Young, who has approximately 20 years of experience supervising the information technology function.


text: Mr. Hernandez is responsible for hiring appropriate personnel, helping to develop the Company's cybersecurity risk management strategy and communicating key priorities to relevant personnel. Mr. Hernandez is also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Mr. Young is responsible for approving cybersecurity-related budgets.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our CFO and Chief Executive Officer. Senior management through the CISSC works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management activities and processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats. We have, for example, implemented a process to monitor for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management efforts, we leverage a managed service provider that provides ongoing support for the protection of our information technology infrastructure.

companyName: ImageneBio, Inc.

ticker: IMA


text: We have an employee security awareness training program that is designed to raise awareness of cybersecurity threats across functions, as well as to encourage consideration of cybersecurity risks across our company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems or store our confidential clinical trial data, including, as appropriate, through review of System and Organization Controls reports and security questionnaires and the inclusion of cybersecurity requirements in relevant contracts.


text: As part of our cybersecurity risk management, we have adopted an incident response plan that has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see "Risk Factors."


text: Cybersecurity Governance We leverage the support of third-party information technology and security providers for the maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. These third-party providers directly report to, and meet periodically with, our Senior Vice President of Finance and Administration to discuss and review our cybersecurity risk management processes.


text: Our board of directors has delegated oversight of our company's cybersecurity risk management to our audit committee. The audit committee, pursuant to the audit committee charter, is responsible for reviewing our company's information security and technology risks (including cybersecurity), including high-level review of the threat landscape facing our company and our company's strategy to mitigate cybersecurity risks and potential breaches. We have a process for our Senior Vice President of Finance and Administration and/or our Chief Financial Officer, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program and on an as needed basis.


text: Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or patients, and violation of data privacy or security laws. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) approach, which is subject to oversight by our Board of Directors. Our cybersecurity policies and practices are aligned with relevant industry standards and are designed to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to cybersecurity risks. Key aspects of this risk management program include, but are not limited to: • Identifying the source of a cybersecurity threat; • Assessing the severity of a cybersecurity threat; • Implementing cybersecurity countermeasures and mitigation strategies; • Providing our employees with regular training on cybersecurity and the protection of our information systems; • Maintaining and testing a business continuity and disaster recovery program; • Maintaining insurance coverage intended to address cybersecurity and data breach risks; and • Informing and updating management and, as needed, the Audit Committee and our Board of Directors of cybersecurity incidents that may pose a significant risk for the business.


text: Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.


text: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls, and data protection. We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events.


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including cybersecurity consultants, to evaluate and support our risk management systems. We also rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, as well as a description of an event that occurred in March 2023, see "Risk Factors—Risks Related to Our Business—Security breaches, loss of data, and other disruptions could compromise sensitive business or patient information, cause a loss of confidential patient data, employee data, personal information, or prevent access to critical information, and expose us to liability, litigation, and federal and state governmental inquiries and damage our reputation and brand."


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the Audit Committee. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends, as well as how management is addressing or mitigating those risks. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Information Officer (CIO).


text: Our CIO is a member of our executive management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. Our CIO has over twenty-five years of extensive experience in information technology and security, and works in coordination with other members of the management team, including, among others, the Chief Financial Officer and Chief Compliance Officer and their designees. We believe our business leaders have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats.


text: Our CIO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CIO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.


text: GlobalX's Audit Committee, comprising board members and senior management from various departments including IT, operations, legal, risk management, and others, diligently engage in regular cybersecurity risk assessments. These comprehensive assessments are designed to proactively identify potential threats, vulnerabilities, and risks that could impact the integrity and security of the company's airline systems, data infrastructure, and operational continuity. Evaluations span critical areas such as safeguarding flight systems, protecting passenger data, and mitigating operational disruptions.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: Moreover, the GlobalX Audit Committee remains committed to providing timely updates and detailed reports, offering insights into the airline's cybersecurity posture, ongoing initiatives, prevalent incident trends, and active remediation efforts. These reports are meticulously crafted, incorporating key metrics, performance indicators, and actionable recommendations aimed at continual enhancement.


text: The committee vested with cybersecurity oversight consistently conducts periodic reviews of GlobalX's cybersecurity policies, procedures, and controls. These reviews are pivotal in ensuring the ongoing effectiveness of the company's cybersecurity framework and its alignment with emerging threats and evolving industry best practices. Regular updates are meticulously implemented to fortify the company's cybersecurity resilience in response to emerging risks and evolving regulatory requirements.


text: As of December 31, 2024, and 2023, GlobalX remains proud to report that it has no t encountered any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, the Company.


text: Risk Management and Strategy The Company recognizes the importance of a cybersecurity risk management program designed to assess, identify, and manage risk associated with cybersecurity threats. Our cybersecurity risk management program (the "Program") is consistent with the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, which incorporates bank regulatory guidance and principles from the National Institute of Standards and Technology Cybersecurity Framework and includes the following risk-based principles: • Identification, measurement, mitigation, monitoring and reporting of cybersecurity threats based on internal and external information sharing and resources; • Safeguards designed to protect against identified threats, including documented policies and procedures, controls, and employee education and awareness; • Processes to detect cybersecurity events and improve incident response, including routine testing of incident response, recovery and business continuity plans and processes; and • Third-party risk management process to manage cybersecurity risk with service providers, suppliers, and vendors.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: Our Program is designed to adapt to an evolving landscape of emerging cybersecurity threats and advancing technology to determine the Company's cybersecurity preparedness. Through routine data gathering, emerging risks, internal incidents, technology investments and internal controls, our Program and overall cybersecurity risk strategy is adjusted as needed.


text: Our Program is supported by regular training of information security employees and awareness training and activities for executives, directors, and employees through which we communicate our cybersecurity policies, standards, processes and practices to foster a culture of cybersecurity risk management across the Company.


text: Integrated Risk Management The Program is integrated into the Company's enterprise risk management framework and functions to identify risk, form a strategy to manage risk, implement the strategy, test the implementation, and monitor our technology environment to control risk. Our information technology team works closely with stakeholders across security, risk, compliance, operations, other business stakeholders, and senior leadership to conduct an annual cybersecurity risk assessment utilizing the FFIEC Cybersecurity Assessment Tool.


text: Engagement of Third Parties in Connection with Risk Management The Company engages various third parties to evaluate the effectiveness and maturity of our Program. The Company engages an independent third party to audit the cybersecurity risk strategy and preparedness. The Company also maintains cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured. The Company also engages third parties to perform regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate threat actor attacks. Our relationships with third parties enable us to leverage their cybersecurity expertise and industry knowledge to assess our Program and make adjustments as needed.


text: Oversight of Third-party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact the Company in certain circumstances. In response, we have implemented processes for overseeing and managing these risks. The processes include limiting the exposure of our information systems to external systems to the least practical amount, assessing the third parties' information security practices before allowing them to access our information systems or data, requiring third parties to implement appropriate cybersecurity controls in our agreements with them, conducting ongoing monitoring of their compliance with those requirements, and requiring third parties to agree to contractual requirements designed to ensure cybersecurity concepts are appropriately addressed.


text: Risks from Cybersecurity Threats As of the date of this report, we have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Board of Directors Oversight Our Board's Audit Committee oversees cybersecurity risk.


text: Management's Role in Cybersecurity Risk Management Given the important role of technology in the Company's operations and customer service, the Company has established an Information Technology Steering Committee, which consists of our IT Manager, President and Chief Risk Officer, Chief Operations Officer, Chief Financial Officer, Mortgage Systems Administrator and Enterprise Risk Manager. The Information Technology Steering Committee reviews, monitors, aligns, and prioritizes all significant strategic information technology initiatives and security risks. The Information Technology Steering Committee reports to the Audit Committee and minutes of the committee's meetings are subsequently reported by the Audit Committee to the Company's Board of Directors. Our IT Manager, in collaboration with our Enterprise Risk Manager make monthly/quarterly reports to the Information Technology Steering Committee. Such reports include updates related to key metrics, key risk indicators, key performance indicators, penetration test results, risk assessment results, project updates, incident reports, compliance matters, and operational issues.


text: Risk Management Personnel The IT Manager has the primary responsibility for managing the Program to identify, assess, manage and control cybersecurity risk. The IT Manager reports directly to our Chief Operations Officer. Our IT Manager has approximately 20 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.


text: Monitoring Cybersecurity Incidents The IT Manager is continually informed of and monitors cybersecurity risks and incidents. In the event of a cybersecurity incident, the Company has developed an incident response plan to timely report cybersecurity incidents to our executive management team, the Audit Committee and Board of Directors, as necessary. In addition to facilitating timely evaluation, escalation and reporting of cybersecurity incidents, this plan also sets forth the process for identifying and assessing the severity of cybersecurity incidents, as well as monitoring post-incident mitigation and remediation.


text: Reporting to Board of Directors The Audit Committee receives reports from the Chief Operations Officer, IT Manager or Enterprise Risk Manager and briefings on our information security and enterprise risk management programs at least quarterly, including the results of any external audits, bank regulatory examinations and evaluations, as well as maturity assessments of our information security program.


text: Risk Management and Strategy In the ordinary course of its business, the Bank relies on electronic communications and information systems to conduct its operations and to store sensitive data, and employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding these defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While the Bank has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Bank's systems and those of its customers and third-party service providers are under constant threat and it is possible that we could experience a future significant event. The Bank expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. For further discussion of risks related to cybersecurity, see "Item 1A Risk Factors."

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: Key elements of our cybersecurity risk management program includes but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profiles.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our CROs or other contractors or consultants we may utilize, may fail, suffer disruptions or suffer security breaches, which could result in a material disruption of our product development programs."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management and, where applicable, external experts, as part of our efforts to keep the Board updated on topics that impact similarly-sized biopharmaceutical public companies.


text: Our Director of Information Technology Infrastructure and Operations, who reports to the Chief Financial Officer, is primarily responsible for assessing and managing material risks from cybersecurity threats. Our Director of Information Technology Infrastructure and Operations has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity resources. Our Director of Information Technology Infrastructure and Operations' experience includes information systems architecture, operations, cybersecurity, and data privacy protection.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company employs a cybersecurity policy which it believes is appropriate for the potential of cybersecurity threats faced by it. The Company does not have possession of personally identifiable patient information from its clinical trials, nor does it have information with respect to third party credit or banking information. Accordingly, the threat is limited to disruption of ordinary business operations. The Company's information systems and maintenance are delegated to independent information technology and cybersecurity consultants, with at least 10 years of experience advising similarly situated companies on information technology and cybersecurity risk management, who report to the Company's Chief Financial Officer, who reports in turn directly to the Board of Directors and the Audit Committee, which is the principal committee charged with the Board's risk management oversite. The Company has never been affected by cybersecurity incidents.

companyName: REVELATION BIOSCIENCES, INC.

ticker: REVB


text: The Company's information systems employ storage and recovery services from various third parties, including Microsoft, as its cloud service providers, which provides an additional level of protection from cybersecurity threats.


text: Cyber Risk Management and Strategy The Company relies on electronic systems and information technologies to conduct its operations. We have adopted and maintain a cybersecurity risk management program, in accordance with our risk profile and business, that is informed by industry standards. The risk management program and the security policies that have been established as part of it, are reviewed annually as part of our overall risk management procedures.

companyName: Adicet Bio, Inc.

ticker: ACET


text: Onex Corp. maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Onex Corp.'s cybersecurity management team periodically discusses and reviews cybersecurity risks and related mitigants at its Cybersecurity Excellence Quarterly Forum.

companyName: Onex Direct Lending BDC Fund


text: We leverage the support of third-party information technology and security providers, including to perform penetration testing, threat intelligence analysis and remediation, when necessary. We have previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we have endeavored to adapt our cyber risk strategy to mitigate emerging cybersecurity risks. We implement a multi-layered approach to cybersecurity that includes, for example, employee security awareness training, various security tools and technologies, and incident response planning and remediation.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, please see the section entitled "Risk Factors" as well as Item 9A in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Executive Director of Information Technology (IT) reports directly to our Chief Financial Officer (CFO) and is responsible for the strategic leadership and direction of our cybersecurity program, with support from our Associate Director of Information Security and Associate Director of IT. With over 20 years of experience in IT and cybersecurity risk management, our Executive Director of IT works alongside individuals across other Company management functions to establish and implement our cybersecurity risk management strategy. Our Executive Director of IT is informed of and monitors cybersecurity incidents through communications with system users as well as monitoring our intrusion detection systems and firewalls.


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program pursuant to the audit committee's charter. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities from our Executive Director of IT or CFO. The audit committee may update the full board of directors on matters relating to cybersecurity risk management as needed.


text: Risks Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IGM Biosciences, Inc.


text: We conduct annual risk assessments and perform as needed updates to our risk register to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of Information Technology (IT), who is also our Senior Vice President (SVP) of Group Operations and reports to our Chief Financial Officer (CFO), to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with Legal, Human Resources and IT. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and company-wide communications.


text: We engage an experienced cybersecurity consultant as our Interim Information Security Advisor who coordinates our risk assessment processes with our Cybersecurity Steering Committee. We engage an experienced service provider as our 24x7 network and security operations center, to assist us to design and implement our cybersecurity policies and procedures, and to monitor and test our safeguards.


text: We assess the ability of our key third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: We recognize the critical importance of protecting our information technology ("IT") systems and the data of our employees, customers, patients, and partners. We have an enterprise-wide cybersecurity program designed to identify, detect, investigate, protect, and respond to cybersecurity risks.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: Our SVP of Group Operations and our Cybersecurity Steering Committee, which includes a cross-functional leadership team, are primarily responsible for assessing and managing our material risks from cybersecurity threats. As part of our risk identification, assessment, and mitigation activities, we leverage the experience of our external cybersecurity advisor/consultant (CISSP, CISA, CISM, CRISC, QSA) who has extensive cybersecurity expertise across various industries. Our SVP of Group Operations, who manages our cybersecurity program, has over 25 years of experience in the Life-Sciences IT space, with over 8 years in IT security and cybersecurity functions.


text: Our SVP of Group Operations, in collaboration with our Cybersecurity Steering Committee, oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our SVP of Group Operations is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through oversight of the external consultant and the IT department, which includes oversight of a combination of automated technologies and manual responses to detect, respond and recover from any cybersecurity incident, as well as oversight of the 24x7 network and security operations center. Our SVP of Group Operations is responsible for informing our executive leadership and our Audit Committee about confirmed cybersecurity incidents, and for providing regular updates to senior executive management, including our CFO, concerning our IT and cybersecurity posture.


text: Our SVP of Group Operations provides quarterly briefings to the audit committee and our executive management regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Risk Strategy and Management Our cybersecurity strategy is focused on cyber-resilience, the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use or are enabled by cyber resources. Continuous improvement actions are designed to drive to a zero-trust architecture and a cyber-resilient enterprise. While this cyber-resilience strategy is in place, our systems, and those of our customers, suppliers and other service providers, are subject to cybersecurity incidents. A system disruption could result in business disruption, theft of our intellectual property, trade secrets or customer information and unauthorized access to personnel information. The Company maintains safeguards, including training, incident response reviews, cybersecurity insurance and business continuity mechanisms to protect the Company's assets. The Company also leverages a third-party cybersecurity program with the goal of minimizing disruption to the business and production operations, strengthening supply chain resilience in response to cyber-related events. To the extent that our business is interrupted, or data is lost, destroyed or inappropriately used or disclosed, such disruptions could significantly and adversely affect our competitive position, relationships with our customers and other stakeholders, financial condition, operating results and cash flows. In addition, we may be required to incur significant costs to protect against these disruptions or security breaches in the future.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: Superior employs a risk-based vulnerability management process for assessing and managing cybersecurity risk. Utilizing the National Institute of Standards and Technology ("NIST") cybersecurity framework, the IT team assesses the risk based on the Center for Internet Security Critical Security Controls. The assessment includes the ability to identify, protect, detect, respond and recover from cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. The risk-based vulnerability management prioritizes action under both an asset context and vulnerability context, considering factors such as asset exposure, potential business effect, threat context, and vulnerability severity.


text: Business email compromise ("BEC") continues to be a top threat for cybersecurity risk leading to potential financial loss, data breach or further information systems compromise. Variants and combinations of BEC, including phishing, spear phishing, "adversary in the middle" attacks (i.e., attacks that allow interception of network communications) and, in particular, "zero-day" attacks (i.e., attacks that exploit a previously unknown vulnerability), present a financial, data loss and business continuity risk. The risk of these attacks exists within the Company, within our customer partners and within our vendor partners in the supply chain. BEC prevention is a top focus in our risk-based cyber-resiliency strategy. In addition to BEC, potential vulnerabilities could exist in business systems and associated infrastructure and are mitigated via protocol for managing update "patches"; this protocol is sometimes limited based on the era of legacy systems.


text: Superior engages cybersecurity partners and consultants to help strengthen its cyber-resiliency program. These engagements include but are not limited to incident response ("IR") planning and IR retainers, penetration testing, vulnerability assessments, IR plan testing, and advisement and awareness of latest threat vectors.


text: All of the Company's global suppliers must comply with its Supplier Code of Conduct ("SCOC"). The SCOC contains certain data security and notification requirements, and the Company explicitly maintains the right to monitor and audit compliance with the SCOC.


text: The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats including, for example, managed cybersecurity service providers, cybersecurity software providers, penetration testing firms, threat intelligence service providers, cybersecurity consultants, dark web monitoring services, forensic investigators, and professional services firms, including legal counsel.

companyName: TerrAscend Corp.

ticker: TSNDF


text: Cybersecurity Governance The Board of Directors maintains overall oversight of cybersecurity risk, and the Audit Committee provides direct oversight of the Company's activities to prevent, detect and respond to cybersecurity threats. The Chief Information Officer ("CIO") and a designated system security engineer are the primary responsible management parties to monitor, assess, and manage cybersecurity risk. Our CIO has led global IT organizations for over ten years with direct oversight responsibility for cybersecurity, the global IT landscape and its data integrity. Our security engineer is solely focused on monitoring, assessing, and managing Superior's cybersecurity breach prevention, detection and management, including the ongoing cybersecurity risk education of our employee base. Our security engineer's experience includes the design and implementation of IT security systems, tools, and processes, comprehensive security assessments, and the implementation of remediating action plans for detected weaknesses.


text: Risk is monitored and managed through a combination of vulnerability assessments, continuous monitoring, endpoint protection, incident response planning, security awareness training, regulatory compliance monitoring, and threat intelligence.


text: Utilizing the NIST cybersecurity framework, the CIO provides quarterly updates to the Audit Committee on cybersecurity risk management, including the Company's latest risk assessment, action plan status and metrics. The Audit Committee regularly briefs the full Board on these matters. In addition, the CIO provides an annual report to the Board on the Company's cybersecurity plan and key activities.


text: Management roles and responsibilities of Superior's cybersecurity incident management are defined within the Company's IR plan. The plan includes the formation of the Security Incident Response Team responsible for leading incident response. In the event of specific cybersecurity incidents, defined sub-teams are engaged, as necessary, to monitor the mitigation and remediation of cybersecurity incidents. These sub-teams are comprised of cross-functional experts including, but not limited to, legal, accounting, operational and IT leadership and relevant external counsel.


text: All incidents are prioritized and assessed for materiality. Cybersecurity incidents are reported to relevant stakeholders in accordance with the incident response plan. All notable cybersecurity incidents as well as the number of cybersecurity incidents are reported quarterly to the Board of Directors.


text: Risk management and strategy The Company has implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and its critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient data ("Information Systems and Data").


text: The Company's cybersecurity function, led by its Chief Information Officer ("CIO") and Senior Director of Information Technology ("IT"), as well as its Enterprise Security Architect and third-party service providers, helps identify, assess, and manage the Company's cybersecurity threats and risks. The Company's CIO has over twenty-five years of technology leadership experience including infrastructure design and management, software development, system implementation, cybersecurity, and network design administration. The Company's CIO also has experience in data protection for systems and has supported a complex global public enterprise environment with operations in over 200 countries. The Company's Senior Director of IT has over 11 years of experience developing and leading healthcare solutions and has led the development in web and infrastructure design, serverless architecture, database integrations, SMS, mass-email and mass phone notification solutions and holds a Sarbanes-Oxley Act (SOX) certification. The Company's Enterprise Security Architect has over seven years of experience in assessing risk and protecting data in various technologies from client/server software to cloud based solutions and holds a Certified Information Systems Security Professional designation, a GIAC Certified Incident Handler Certification, and Sarbanes-Oxley Act (SOX) certifications. The Company's Senior Director of IT and the Enterprise Security Architect also have experience dealing directly with numerous cyber security threats, breaches, detection and containment activities and strategies under strict requirements and expectations for HIPAA covered entities. The Company's cybersecurity function works, in certain circumstances, in partnership with its managed security service provider ("MSSP") and managed service provider ("MSP") to help identify, assess, and respond to risks from cybersecurity threats, including by monitoring and evaluating its threat environment using various methods including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating the Company's and its industry's risk profile, evaluating certain threats reported to us, coordinating with law enforcement concerning certain threats, conducting internal and/or external audits, conducting threat assessments for certain internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and use of external intelligence feeds. The Company's Security Incident Response Team leverages a cybersecurity managed detection and response partner, which monitors certain of its endpoints, cloud infrastructure, and networks for irregular activity.


text: Depending on the environment and system, the Company implements and maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to its Information Systems and Data, including, for example: an incident response plan, incident detection and response measures, monitoring and response services, network and system access controls, physical security measures, an employee cybersecurity training program, dedicated cybersecurity personnel, asset management and recovery processes, encryption of certain data, segregation of certain data, implementation of security standards/certifications, a vendor risk management program, penetration testing, dark web monitoring, monthly environment risk reviews, external threat intelligence reports, regular digital infrastructure scans, internally reported threats, data back-up measures, and cybersecurity insurance.


text: The Company's assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is identified in the Company's risk register detailing certain known and potential risk items; the Company's IT operations department works with its MSSP/MSP vendor partners to review certain identified threats and its cybersecurity practices in an effort to prioritize and mitigate cybersecurity threats that are more likely to lead to a material impact on its business; and its CIO regularly presents to senior management, the Board and Audit Committee to evaluate material risks relative to its overall business objectives.


text: The Company uses third-party service providers to perform a variety of functions throughout its business, such as enterprise resource planning, point of sale, eCommerce, wholesale sales, application providers, and web hosting. The Company has a vendor management program to manage cybersecurity risks associated with its use of these providers. The Company's vendor management program includes completion of a cybersecurity questionnaire and review of the vendor's security program for certain vendors designed to help us evaluate the potential cybersecurity risks associated with its use of the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, its vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and imposition of contractual obligations related to cybersecurity on the provider.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the risk factors under Item 1A. "Risk Factors" in this Annual Report, including "The Company (and the third parties with whom it works) faces physical security risks, as well as risks related to its information technology systems, data, potential cyber or phishing-attacks, and security incidents."


text: The Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Company's Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The Company's cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CIO and the Senior Director of IT. The CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the security management department, CIO, Chief Financial Officer ("CFO"), Chief Executive Officer ("CEO") and others. The security management department, CIO, CFO, CEO, and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes reporting to the Board for certain cybersecurity incidents.


text: The Board receives regular reports from the CIO concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. These reports also include materials related to certain cybersecurity trends the Company has identified, potential cybersecurity threats and risk, and proposed mitigation measures.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors, and other business partners.

companyName: EyePoint, Inc.

ticker: EYPT


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards with regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response simulations. We also require cybersecurity training when onboarding new employees and contractors, as well as required cybersecurity awareness training for our employees and contractors/other workforce members. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including maintaining vendor questionnaires/conducting due diligence in connection with onboarding new vendors and engaging in periodic reviews thereafter as appropriate. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: CARGO Therapeutics, Inc.


text: Upon a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of the Chief Legal Officer, Chief People Officer & SVP of IT, Associate General Counsel, Head of Information Technology, and a member of the Financial Reporting team, meets to make an initial assessment. If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our President/Chief Executive Officer, Chief Financial Officer, Chief Legal Officer & Corporate Secretary, and Chief People Officer/SVP of IT.


text: Our team leverages over 25 years of experience in various IT leadership roles, including oversight of cyber security functions. Our SVP of IT, and her team, is responsible for the day-to-day management of the cybersecurity program.


text: The SVP of IT provides periodic briefings for our senior management team on cybersecurity matters, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and cybersecurity threats.


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's cybersecurity and privacy risk exposures and policies. On a quarterly basis, the SVP of IT reports to the Audit Committee on information technology and cybersecurity matters, including key information technology risks. The SVP of IT also apprises the Audit Committee and full Board of Cyber Security Incidents consistent with our incident response program, promptly.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess, and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors." As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.


text: In 2024, we were a SPAC with no business operations other than that following our Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. We assess and identify the possibility of risk from cybersecurity threats considering both our operations and the nature of our assets, which consist solely of the funds in our Trust account managed by a third-party Trustee and the funds in our operating bank account. To date, we have not experienced any cybersecurity attacks. In light of the nature of our operations in identifying and evaluating suitable acquisition transaction candidates, we believe that cybersecurity threats are not reasonably likely to materially affect these business operations. In addition, the procedures in place with third parties that maintain our assets are such that it also should not be reasonably likely for cybersecurity threats to materially affect our financial condition. But we recognize that a penetration of our systems or a third party's systems could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: GigCapital7 Corp.

ticker: GIG


text: We have not adopted any specific cybersecurity risk management program or formal processes for managing risks from cybersecurity threats. However, in our overall risk management processes, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations and assets. These include, but are not limited to, engaging a third-party information technology consultant who maintains and monitors our information technology network, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.


text: Our management is generally responsible for assessing and managing risks from any cybersecurity threats, including through the use of the third-party information technology consultant who reports to our management on actions that he is undertaking and the cybersecurity threats that he sees to our information technology network. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to the Audit Committee of our Board of Directors (which is the committee of the Board of Directors to which oversight of cybersecurity matters and management of cybersecurity incidents has been delegated by the Board of Directors) for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the Audit Committee or the Board of Directors deems appropriate to take. In addition, our management reports to the Audit Committee on a regular basis on the potential for risks from cybersecurity threats.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company relies on the Investment Advisor to implement the cybersecurity program. The cyber risk management program involves risk assessments relating to the information systems of the Investment Advisor, incident response training and testing, implementation of security measures, and ongoing monitoring of systems and networks and assessment of the associated risks on an annual basis, including networks on which the Company relies on. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Investment Advisor has engaged external experts, including consultants, to evaluate cybersecurity measures and risk management processes. The Company depends on and engages various third parties, including suppliers, vendors, and service providers. The compliance team of the Company and the Investment Advisor will conduct onboarding and ongoing due diligence of each third-party engaged by them, including identify and oversee risks from cybersecurity threats associated with their use of such entities.

companyName: FIDUS INVESTMENT Corp

ticker: FDUS


text: Board Oversight of Cybersecurity Risks The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to the Company's risk management, including risks associated with cybersecurity threats. Certain members of the Company's management will periodically report to the Board, on at least a quarterly basis, on cybersecurity matters, such as the overall state of the Company's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and material cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management The Company's management is responsible for assessing and managing material risks from cybersecurity threats, in consultations with cybersecurity consultants engaged by the Investment Advisor. The Company's management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, and/or information technology.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes has materially affected, or are reasonably likely to materially affect, the Company, including the Company's business strategy, operational results, and financial condition.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks, systems and data. Such processes include physical, procedural, and technical safeguards, employee training and incident simulations. We have the capacity to engage certain external parties, such as consultants, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We also consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: To help manage our material risks from cybersecurity threats and to help protect against, detect, and prepare to respond to cybersecurity incidents, we conduct periodic training for employees involved in our systems and processes that handle sensitive data. We also conduct on-boarding cybersecurity awareness assessments, cybersecurity training for all employees, and regular phishing email simulations for all employees. In addition, we use technology-based tools to help mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: The Audit Committee of our Board of Directors provides oversight of our cybersecurity risk and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Senior Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help us prepare our employees to address cybersecurity risks. Our Senior Director of Information Technology has over seventeen years of experience in information technology, eleven years of experience in information technology for life sciences companies, and a relevant bachelor's degree in information technology. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy. We recognize the critical role that cybersecurity plays in protecting our operations, customers, and digital assets. As part of our broader technology and information security risk management framework, our cybersecurity strategy is designed to safeguard the confidentiality, integrity and availability of our systems and data. We continuously assess, strengthen and refine our cybersecurity practices to adapt to an evolving threat landscape.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC