text: The Company's Board of Directors is responsible for the oversight of management's efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company's cybersecurity risk management strategy. Management also updates the Audit Committee and the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats.


text: During the fiscal year ended June 30, 2024, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: EVI INDUSTRIES, INC.

ticker: EVI

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: Robust cybersecurity is an essential component of our strategic vision. We face a variety of complex cybersecurity threats as a defense contractor. Among the risks are computer malware, ransomware, phishing attacks, Denial of Service attacks and Advanced Persistent Threats. Our security team, comprised of members from senior management, IT, human resources and program management, performs routine risk assessments in accordance with NIST 800-30, using input from observed risks and threats, advisories, federal agencies and local law enforcement. The Audit Committee of the Board of Directors is responsible for oversight of our risk management processes. The Audit Committee is briefed by senior management on cybersecurity posture, initiatives and incidents. We allocate significant resources to mitigate these risks. We are required to adhere to rigorous regulations, such as those outlined in the Defense Federal Acquisition Regulation Supplement (DFARS), which govern the protection of controlled unclassified information (CUI) and the mandatory reporting of cybersecurity incidents to the Department of Defense (DoD).

companyName: ESPEY MFG & ELECTRONICS CORP

ticker: ESP

stage1Category: Risk Management Process

stage1Method: majority


text: All DFARS requirements are flowed down to our sub-contractors, who are required to self-report their compliance to the U.S. Government. In addition to the processes and systems that we use to identify and mitigate risks, we utilize third party services to conduct valuations of our security controls, including penetration testing and independent audits. Despite our efforts to uphold the highest cybersecurity standards, we may still experience a cybersecurity incident that has a material effect on business strategy, results of operation or financial condition. It is also possible that additional regulations could affect our supply chain and increase costs. Prior cyberattacks directed at us have not had a material impact on our financial results nor restricted us from being awarded contracts from other defense companies or directly from the United States Department of Defense. However, we can provide no assurance that the occurrence of any future event would not adversely affect our internal operations, our reputation and competitive advantage, and our future financial results.

stage1Category: Third-Party Risk


text: has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Risk Oversight Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: STURM RUGER & CO INC

ticker: RGR


text: has an Information Security Program ("Program") to protect personal and proprietary information in compliance with applicable federal and state requirements. The Program is designed to: Ensure the security and confidentiality of employee and customer personal information and Company proprietary information;


text: The Company's Board of Directors has assigned oversight of cybersecurity risk management to the Risk Oversight Committee. The Risk Oversight Committee regularly receives reports from management, including senior information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, the Company's full Board of Directors receives reports addressing cybersecurity as part of the Company's overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Senior IT leaders are responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and Company management and reports to the Company's Board of Directors and/or certain Board committees.

stage1Category: Board Governance


text: Cybersecurity Program The Company's cybersecurity program is an integral element of the Company's overarching strategic plan and risk management system. The robustness of the cybersecurity initiatives directly impact the realization of the Company's mission, vision, and goals. Aligned with the National Institute of Standards and Technology Cyber Security Framework, the Company employs a comprehensive "defense-in-depth" strategy, deploying multiple security measures to safeguard its operational environment and data integrity systems.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: The Company continually evaluates and refines its cybersecurity program in response to key factors such as evolving threat landscapes, program maturation, gap analysis, and guidance from external security consultants. The Company's cybersecurity program relies on three key pillars: People, Process and Technology (PPT) to deliver a robust cybersecurity program. The cybersecurity program includes various aspects of PPT, including, but not limited to: Technology: Encryption, threat management, backups, monitoring, investigative support utilizing artificial intelligence embedded tools; Identity and Access Control Management Tools: Multi-factor authentication, monitoring and alerting of privilege account access; Cybersecurity Processes: Vulnerability scanning, penetration testing, and periodic assessments conducted by external security consultants;


text: Incident Response Training: Regularly assessed incident response preparedness through various incident response and disaster recovery exercises; and Cyber Risk Awareness and Training: Frequent simulation exercises to heighten awareness of cybersecurity threats and educate our user community on preventative measures and reporting protocols. All employees participate in required periodic training with respect to cybersecurity risk and risk mitigation.


text: Our Chief Technology Officer (CTO), with over 25 years of experience in various disciplines of information technology, oversees the cybersecurity program. Reporting to the Chief Executive Officer, the CTO provides regular briefs to the Board of Directors (the Board) and executive management, informing them about prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as ongoing risks and threats.


text: In our industry, the continuous functioning of information systems is of the utmost importance. Leveraging information technology systems, we collect, process and safeguard sensitive data and utilize automated tools to operate our plants.


text: Cybersecurity threats encompass potential hazards such as malicious code, employee misconduct, advanced persistent threats, fraud, and phishing attacks. These risks have the potential to lead to information technology system failures, threat to water supply, or compromise of sensitive information.

stage1Category: None/Other


text: Our cybersecurity program aims to protect the uninterrupted availability of critical information technology resources. Regular assessments, conducted both internally and by third parties, evaluate our program against industry standards, including the National Institute of Standards and Technology Cybersecurity Standard and the Risk Management Framework.


text: Although we have not experienced cybersecurity breaches or incidents that have significantly impacted our financial condition, results of operations, or business strategy, the effectiveness of our measures to prevent, detect, mitigate, or recover is based on currently known threats and recovery methods. There is no guarantee that cybersecurity breaches or incidents will not impact our business operations, strategy, financial condition, or operations.


text: The ever-evolving landscape of cybersecurity threats introduces ongoing challenges. The Company recognizes the increasing frequency and sophistication of these threats. Despite implementing measures to secure operational and technology systems and fostering a culture of continuous improvement, the dynamic nature of cyber-attacks and vulnerabilities implies that these defenses may not be foolproof.


text: Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: Cybersecurity risk management strategy is an integral component of our operations and our overall risk management process. Recognizing the dynamic nature of cybersecurity threats, we have implemented a comprehensive risk management program that aims to identify, assess, and mitigate potential risks. Our strategy involves a proactive approach, incorporating preventative measures, continuous monitoring, and adaptive response mechanisms. We prioritize the safeguarding of our operational network environment, sensitive data, including confidential business information and personal details of our customers and employees. Regular assessments conducted both internally and by third parties ensure our cybersecurity program aligns with industry standards. In addition to a dedicated cybersecurity team, we employ a defense-in-depth strategy, utilizing multiple security measures to protect our information technology system. Collaboration with third-party experts, industry peers and ongoing training initiatives ensures our cybersecurity strategy remains robust and responsive to evolving threats. We understand the importance of maintaining a vigilant and adaptive stance in the ever-evolving landscape of cybersecurity to safeguard our business operations, financial stability, and as a direct result, our overall success. A dedicated cybersecurity team; Collaboration with a third-party managed detection and response company for 24/7 monitoring and response; Cybersecurity insurance to cover a portion of losses and damages resulting from cyber-attacks or security breaches; An incident response team that is comprised of various departments required for an effective response; Conducting periodic drills and exercises, including industry collaborations and participation from the executive team; Continuous information security awareness training and phishing simulation exercises; Regular security assessments to address evolving risks and threats;


text: Deployment of automation solutions to strengthen detection and response capabilities; and Utilizing services offered by the United States Department of Homeland Security to assist with resiliency planning.


text: Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations. In connection with these relationships, we perform due diligence, cyber risk scoring, cybersecurity related contractual obligations, and periodic reviews of third-party control environments to ensure alignment with the Company's risk exposure, business requirements, and risk tolerances.


text: We extend our cybersecurity focus to third-party service providers by evaluating and monitoring their cybersecurity risks. High-risk vendors undergo continuous monitoring, and we maintain contractual agreements that mandate our third-party providers' commitment to managing cybersecurity risks, providing incident notifications, and being subject to cybersecurity audits.


text: Cybersecurity Governance The Corporate Governance and Nominating Committee of the Board is tasked with serving as the Board of Director's primary body to oversee management's risk identification, management and mitigation strategies related to, among other risks, information technology, cybersecurity and data security risks. Management, including the CTO, provides regular reports to the Board covering aspects such as risks, threats, the evolving threat landscape, enhancements to the cybersecurity program, and the preparedness of internal responses.


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as the personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.

companyName: ENB Financial Corp

ticker: ENBP


text: The Corporation has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; a business continuity program (BCP) to ensure continuity of operations; and an incident response program documenting cybersecurity incident response and notification procedures. The Corporation's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees.


text: The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors. The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response, and holds multiple relevant professional certifications. The ISO provides periodic updates to the Board of Directors, including a comprehensive annual report. The Information Security, Vendor Management, BCP, and Incident Response Programs are approved by the Board annually.

stage1Category: Management Role


text: The ISO maintains risk assessments for critical IT systems, vendors, and processes. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are used annually to assess these risks. Third parties are assessed to address their risks according to service type, compliance risk, financial risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on that assessment.


text: The ISO conducts training on cybersecurity risks for all new employees, and at least annually for existing employees and the Board of Directors. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks and to provide supplemental training as needed. The Corporation uses data loss prevention and web filtering software to ensure malicious data does not enter the Corporation's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. We employ an in-depth, layered, defensive strategy with respect to our products, services, and technology.


text: Robust cybersecurity is an essential component of our strategic vision. We face a variety of complex cybersecurity threats as a defense contractor. Among the risks are computer malware, ransomware, phishing attacks, Denial of Service attacks and Advanced Persistent Threats. Our security team, comprised of members from senior management, IT, human resources and program management, performs routine risk assessments in accordance with NIST 800-30, using input from observed risks and threats, advisories, federal agencies and local law enforcement. The Audit Committee of the Board of Directors is responsible for oversight of our risk management processes. The Audit Committee is briefed by senior management on cybersecurity posture, initiatives and incidents. We allocate significant resources to mitigate these risks. We are required to adhere to rigorous regulations, such as those outlined in the Defense Federal Acquisition Regulation Supplement (DFARS), which govern the protection of controlled unclassified information (CUI) and the mandatory reporting of cybersecurity incidents to the Department of Defense (DoD). All DFARS requirements are flowed down to our sub-contractors, who are required to self-report their compliance to the U.S. Government. In addition to the processes and systems that we use to identify and mitigate risks, we utilize third party services to conduct valuations of our security controls, including penetration testing and independent audits. Despite our efforts to uphold the highest cybersecurity standards, we may still experience a cybersecurity incident that has a material effect on business strategy, results of operation or financial condition. It is also possible that additional regulations could affect our supply chain and increase costs. Prior cyberattacks directed at us have not had a material impact on our financial results nor restricted us from being awarded contracts from other defense companies or directly from the United States Department of Defense. However, we can provide no assurance that the occurrence of any future event would not adversely affect our internal operations, our reputation and competitive advantage, and our future financial results.


text: We are committed to safeguarding our information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction. Our program to protect our information assets and the management of risks to those assets supports the confidentiality, integrity, and availability of the information necessary to our long-term business success.

companyName: FLANIGANS ENTERPRISES INC

ticker: BDL


text: Our cybersecurity risk management the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis; cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management;


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;


text: of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Prevention System (IPS) that scans data in transit to help prevent the execution third-party risk management process for service providers, suppliers, and vendors who have access to our information systems.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or are effective in protecting our systems and information. We are not currently aware of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Directors has oversight responsibility for the Company's cybersecurity risk management, including technology and cybersecurity risks facing the Company. Management updates the Board, as necessary, regarding cybersecurity risk management matters, including reporting any material cybersecurity incidents.


text: Our management team, including the CEO, CFO, COO, Senior Director of Information Technology, Director of Information Technology, and Director of Accounting, as appropriate, supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy The Partnership recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Managing Material Risks & Integrated Overall Risk Management The Partnership has strategically integrated cybersecurity risk management into our broader risk management framework to promote an entity-wide culture of cybersecurity risk management. Our information technology department works closely with our internal audit, risk, and legal teams to continuously evaluate and address cybersecurity risks and ensure cybersecurity measures are in alignment with our business objectives and operational needs.


text: Our cybersecurity measures are designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use multiple monitoring and detection tools to safeguard network and endpoint devices. We have implemented measures that proactively and continuously assess and monitor our information systems for vulnerabilities and cybersecurity exposure.


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Partnership engages with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. Our collaboration with these third parties includes regular audits, network penetration testing, threat assessments, and consultation on security enhancements.


text: We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees with network access are required to complete annual security awareness training and quarterly spear phishing exercises.


text: Oversee Third-Party Risk Because we are aware of the risks associated with third-party vendors, service providers and business partners, we have implemented stringent processes to oversee and manage these risks. We conduct thorough and annual security assessments of all third-party file transfer protocols, and we perform in-depth reviews of hosted applications including, but not limited to, confirmation of SOC 2, ISO 27001, or other relevant security certifications.


text: Risks from Cybersecurity Threats We have not been subject to cybersecurity challenges that have materially impaired or are reasonably likely to materially impair our operations or financial standing.


text: The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The board has established robust oversight mechanisms and is willing to cause the Partnership to expend significant resources to further enhance digital security or to remediate vulnerabilities to ensure effective governance in managing risks associated with cybersecurity threats. The Board recognizes the significance of these cybersecurity threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight The Partnership's board of directors has oversight of cybersecurity risks. Our board of directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The Director of Internal Audit and the Chief Financial Officer ("CFO") play a pivotal role in informing the board of directors on cybersecurity risks. They provide comprehensive briefings to the board of directors on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the board of directors, Director of Internal Audit, Director of Information Technology and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The board of directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Partnership. The board of directors conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Reporting to Board of Directors The Directors of Information Technology and Internal Audit regularly inform executive management of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Partnership. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the board of directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Monitor Cybersecurity Incidents The Director of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The Director of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Partnership's information technology team is equipped with an incident response plan. This plan includes immediate actions to mitigate and contain the impact and strategies for remediation and prevention of future incidents.


text: Risk Management & Strategy The Company is in the process of maintaining a robust cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats, which encompasses these areas: risk assessment, incident detection and response, third-party risk, governance, board of directors' oversight, and management's role in managing cybersecurity risk.

companyName: America Great Health


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board of Directors has established robust oversight mechanisms and is willing to cause the Partnership to expend significant resources to further enhance digital security or to remediate vulnerabilities to ensure effective governance in managing risks associated with cybersecurity threats. The Board of Directors recognizes the significance of these cybersecurity threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight The Partnership's Board of Directors has oversight of cybersecurity risks. The Board of Directors is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The Director of Internal Audit and the Chief Financial Officer ("CFO") play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to the Board of Directors on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Board of Directors, Director of Internal Audit, Director of Information Technology and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board of Directors' oversight is proactive and responsive. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Partnership. The Board of Directors conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Reporting to the Board of Directors The Directors of Information Technology and Internal Audit regularly inform executive management of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Partnership. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The cybersecurity function performs an annual threat and risk assessment that drives our security strategy. The strategy is aligned to the ISO 27001/02 and NIST cybersecurity frameworks, which drive our security policies and procedures. These policies and procedures, along with enabling security technology and qualified security function employees, maintain activities to prevent, detect, and minimize the effects of cybersecurity incidents. Cybersecurity technology and practices are in place to enable the protection of consumer and employee personal data and confidential information.

companyName: FIVE BELOW, INC

ticker: FIVE


text: Risk Management and Strategy Our cybersecurity program is designed to protect the confidentiality, integrity and availability of critical assets and information, using a proactive and risk-based approach. We utilize the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as other globally recognized standards. The NIST framework is structured around six Core Functions (Govern, Identify, Protect, Detect, Recover and Respond) and is a comprehensive approach to information and cybersecurity risk management. Our program includes policies, practices, procedures and controls designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments.

companyName: TD SYNNEX CORP

ticker: SNX


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our company's broader overall risk assessment process. We refine our cybersecurity program by staying informed on security threats, conducting tabletop exercises to proactively identify areas for improvements, and leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. We utilize a third-party remediation team on retainer for assistance in investigating and addressing cybersecurity incidents or threats. We maintain procedures for screening and evaluating third-party providers prior to granting them access to our information systems. Depending on the nature of the product or service to be provided, we screen any third-parties that could present a cybersecurity risk through a cyber risk assessment, and we review third-party suppliers post-engagement to identify changes in their security risk profile, including the occurrence of cybersecurity events affecting such suppliers. Contractual and statutory provisions require third-party suppliers to inform us of cyber incidents, in most cases. Additionally, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents.


text: While we focus on prevention and detection, we also have incident response and recovery plans in place designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. In the event of a cybersecurity incident, our incident response process involves assessing incident severity, conducting root cause analysis, creating and implementing plans to address the incident, mobilizing appropriate resources and identifying potential remedial measures and other appropriate next steps. We also have on retainer a third-party consultant to assist us in our incident response and remediation.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see " Item 1A. Risk Factors."


text: We have a team of information security professionals who lead our enterprise-wide cybersecurity strategy, risk management, cyber defense, software security, security monitoring and other related functions. This team is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Information Officer ("CIO") and works with our Chief Legal Officer. Our CISO has over 30 years of experience in the fields of cybersecurity and intelligence with the Department of Defense, the defense contracting community and with publicly traded companies, and holds various technical credentials in the field, including a CIO Program Certificate from the College of Information and Cyberspace, National Defense University, and maintains a Certified Information System Security Professional ("CISSP") designation as well as a Certified Information Privacy Professional ("CIPP") designation.


text: The Board of Directors is responsible for overseeing our enterprise risk management process, including our information security program, compliance and risk management and cybersecurity risks. The CISO regularly provides reporting on cybersecurity matters to senior management and reports to the Board of Directors on at least a semi-annual basis and, going forward, to the newly formed Technology Committee of the Board of Directors on at least a quarterly basis. This reporting includes updates on our information security strategy, key cyber risks and threats, progress towards protecting the Company from such risks and threats, and assessments of our cybersecurity program with regard to emerging trends. Depending on the magnitude of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our security incident response plan.


text: The Board of Directors is in the process of creating a Technology Committee to have an oversight role regarding technology-based issues, including in relation to cybersecurity and generative artificial intelligence. With respect to cybersecurity, the committee's role may include assisting the Board of Directors in evaluating management's role in preparing, presenting and assessing our IT systems, reviewing our cyber risks and strategies as well as any significant incidents, and providing guidance regarding the Company's cybersecurity compliance obligations.


text: We periodically engage qualified third parties to perform external assessments and audits of our overall security program, as well as to perform detailed security assessments of various components of our overall technology infrastructure. We also supplement our own internal expertise with qualified third parties to engage in varying security operational functions aiding in the identification and remediation of potential cybersecurity threats.


text: We require employees and temporary staffing to complete annual training on information security, including cybersecurity, global data privacy requirements and compliance measures.


text: We have implemented a third-party service provider risk assessment program to assess material cyber threats associated with using third party providers. This program is designed to assess risk prior to the onboarding of new providers as well as to review high risk and medium risk providers on an annual basis.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.


text: We have integrated governance processes into our overall risk management framework to enable the Board of Directors to oversee cybersecurity risk. The Audit Committee oversees management's policies and procedures related to cybersecurity risk management and periodically reports to the Board of Directors. The Chairman of the Audit Committee acts as the lead with respect to direct oversight of management.


text: Our Board of Directors considers cybersecurity risks through interaction with our management team and the Audit Committee, as well as through quarterly updates with our CISO.


text: Management informs the Audit Committee of material aspects of our cybersecurity program on a quarterly basis. This includes informing the committee on key strategic and operational goals, risk mitigation efforts, performance metrics, and descriptions and notification of emerging or existing risks as well as incidents impacting us.


text: Management assesses and considers cybersecurity risks through its enterprise risk management program, consultation with external advisors, as well as through discussions with our CIO and CISO. We have an experienced and dedicated CISO, who has served in various roles in information technology, technology audit and security over the past 38 years, including serving as a senior partner in charge of various information security and business resiliency practices at one of the Big 4 Accounting consultancies, advising some of the largest public company leadership teams and boards of directors on cyber related issues and projects. The CISO also served as the CISO for one of the Big 4, as well as a retail ecommerce business virtual CISO. The CISO holds an undergraduate degree in Management Information Systems and has attained the professional certification of Certified Information Systems Auditor.


text: Management is informed of cybersecurity risks and activities as part of the quarterly business review of the Information Technology function.


text: Cybersecurity risk is assessed at the enterprise level as part of our overall enterprise risk management program. We maintain a dedicated cybersecurity function and program that is led by the Chief Information Security Officer ("CISO").


text: The cybersecurity function performs an annual threat and risk assessment that drives our security strategy. The strategy is aligned to the ISO 27001/02 and NIST cybersecurity frameworks, which drive our security policies and procedures. These policies and procedures, along with enabling security technology and qualified security function employees, maintain activities to prevent, detect, and minimize the effects of cybersecurity incidents. Cybersecurity technology and practices are in place to enable the protection of consumer and employee personal data and confidential information.


text: We maintain incident response plans and playbooks that allow for cybersecurity incident response, management and recovery in the event of an incident. These plans are tested on an annual basis.


text: We require the crew and temporary staffing to complete annual training on information security, including cybersecurity, global data privacy requirements and compliance measures.


text: We have implemented a third-party service provider risk assessment program to assess material cyber threats associated with using third-party providers. This program is designed to assess risk prior to the onboarding of new providers as well as to review high risk and medium risk providers on an annual basis.


text: Management assesses and considers cybersecurity risks through its enterprise risk management program, consultation with external advisors, as well as through discussions with our CIO and CISO. We have an experienced and dedicated CISO with over 25 years of Information Technology experience in retail for several globally recognized brands, with the majority of their career focused on all aspects of cybersecurity from delivery to operations including incident response. The CISO holds a Master's Degree in Information Technology, has attained the professional certifications of Chief Information Security Manager and National Association of Corporate Directors, and actively participates in the cybersecurity industry through advisory boards and forums that promote peer to peer collaboration.


text: Risk Management and Strategy We have in place a cross-functional, enterprise-wide cybersecurity program that is integrated into our overall risk management process and strategy and has direct involvement from our senior management and board oversight. Our cybersecurity program is based on industry standard CIS critical security controls. The top risks facing our Company, including those related to cybersecurity, are included in our overall enterprise risk management program that is managed by a cross-functional group chaired by our compliance and internal audit functions.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: To assess, identify, and manage material risks from cybersecurity threats to our information systems and the associated costs, our cybersecurity program prioritizes vulnerability management and risk reduction, detection and prevention. As part of this program, we conduct continuous monitoring for anomalous behavior using a third-party security operations center. In addition, we conduct an annual cybersecurity risk assessment in conjunction with our third-party consultant that specializes in information security, and we incorporate recommendations from the risk assessment into our cybersecurity strategy, as appropriate. This risk assessment process considers the nature of our business, requirements from our internal and external stakeholders, and industry trends and risks, including new and emerging risks. By continuously assessing the cybersecurity landscape, we develop targeted strategies that identify and address the risks most likely to impact our company. We also conduct at least one cybersecurity incident tabletop exercise each year to test and enhance our incident response plans.


text: Our cybersecurity program is designed to detect and prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, efficiently remediate and recover from cybersecurity incidents and ensure compliance with regulations and disclosure requirements. Pursuant to our processes, when a cybersecurity incident occurs, we convene a cross-functional incident response team whose membership is dictated by the severity of the incident but in all instances includes representatives from our information technology, legal and accounting departments. This cross-functional representation allows us to leverage diverse perspectives and expertise when addressing cybersecurity events and to analyze the potential financial, legal, operational, and reputational implications of an incident, thereby enabling us to make informed decisions and take appropriate actions. This incident response framework further enables us to quickly assess the severity of cybersecurity incidents and the materiality of incidents based on pre-defined criteria that considers both quantitative and qualitative factors to determine the appropriate response. Identified incidents are then escalated to the relevant management teams based on their severity, allowing for a swift determination of materiality and an effective mitigation process. If we determine that an incident is not material, we continue to monitor it for subsequent developments.


text: We also utilize third-party service providers as a normal part of our business operations. These third-party service providers may have access to our systems and/or sensitive information. To address cybersecurity risks arising from our third-party service providers, we assess and monitor risks relating to potential compromises of sensitive information at our third-party service providers and reevaluate these risks periodically. We categorize our third-party service providers by criticality, based on the criticality and sensitivity of our data each third-party service provider has access to, and, based on this, we employ a risk-based approach for review of the security measures implemented by each third-party service provider. In addition, we obtain periodic attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.


text: Additionally, to minimize our enterprise-wide risk and exposure to material cybersecurity incidents, we conduct annual cybersecurity awareness training and education for our employees. By equipping our employees with the necessary knowledge and skills, we intend to cultivate a cybersecurity-conscious culture within our organization.


text: We maintain insurance to provide coverage for a portion of the losses and damages that may result from a physical attack, cybersecurity attack or a security breach. Such insurance is subject to several exclusions and may not cover the total loss or damage caused by an attack or a breach. Consequently, costs related to incidents may not be covered by insurance.


text: We design and assess our cybersecurity program based on the CIS Controls and NIST Cybersecurity Framework (CSF). These frameworks provide us with a common language and structure for identifying, assessing, and managing cybersecurity risks across our organization. We do not claim to comply with any technical standards, specifications, or requirements by using these frameworks. They are guides that help us to deal with the cybersecurity risks that are relevant to our business.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Impact of Cybersecurity Risks on Strategy and Results Our business operations and relationships with customers and suppliers are heavily reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business. For example, we collect, store and transmit sensitive information including intellectual property, proprietary business information, including highly sensitive clinical trial data, and personal information in connection with our business operations. The secure maintenance of this information is critical to our operations and business strategy. If this information was subject to a cybersecurity attack or unauthorized access or use, it could have a material adverse effect on our business and could expose us to potential legal consequences, liabilities, mitigation costs, and damage to our reputation. Managing cybersecurity incidents would also divert management's attention and resources from regular business operations.


text: We believe that our current cybersecurity program provides adequate measures of protection against cybersecurity breaches and generally reduces our risks. However, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, our management has determined that, during the period covered by this Annual Report on Form 10-K, no cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, operating results, or financial condition.


text: Our board of directors is responsible for cybersecurity risk management and oversight of our cybersecurity program. The nominating and corporate governance committee of the board of directors assists in the oversight of management's implementation of our information technology policies and monitoring of the risks associated with our information systems, including reviewing and discussing with management our program to identify, assess, manage and monitor cybersecurity risks. The nominating and corporate governance committee regularly reviews technology strategies, physical and cybersecurity threat assessments, emerging issues and related initiatives. In addition, the audit committee of the board of directors coordinates the board of directors' oversight of our disclosure controls and procedures and ensures that we have in place appropriate internal controls, risk assessment policies and procedures, incident response plans and reporting mechanisms. The nominating and corporate governance committee coordinates with the board of directors and audit committee, as appropriate, on matters related to cybersecurity risk.


text: Our board of directors delegates execution of our cybersecurity program to our Chief Information Security Officer, or CISO, who is responsible for the day-to-day management of our cybersecurity program. Our CISO has over 25 years of information security and information technology risk expertise in multiple industries, including financial, manufacturing, healthcare and life sciences, and holds industry standard certifications, including CISSP, CRISC and CISM. Our CISO, together with our Chief Information Officer, or CIO, provides at least two presentations each year to our board of directors or nominating and corporate governance committee on cybersecurity incidents, security program updates and ongoing risks, with additional updates being provided on an as-needed basis. Our CISO also meets periodically with our senior leadership team to review metrics on readiness, incidents, mitigations and remediation. In addition, our internal audit team performs periodic audits of our systems and cybersecurity processes, the results of which are reported to the audit committee and our senior management team.


text: We have established a disclosure committee, which consists of our chief executive officer, chief financial officer, and senior leaders from finance, legal, accounting, corporate communications, and investor relations, including, but not limited to, our Chief Legal Officer, CIO, CISO, chief accounting officer, controller and senior vice president investor relations and corporate communications. The disclosure committee is actively involved in the review and approval of the Company's SEC filings and has responsibility for considering the materiality of information for such filings and, on a timely basis, determining the disclosure of that information. The CISO briefs the disclosure committee, as necessary, on cybersecurity related matters, which includes information regarding our detection, prevention, mitigation, and remediation of cybersecurity incidents and monitoring of previously evaluated cybersecurity incidents for subsequent changes that might impact conclusions on materiality, and this information is presented to the nominating and corporate governance committee, as appropriate.


text: security risk is an area of increasing focus for our Board, particularly as an increasingly significant part of our operations rely on digital technologies. As a result, we have implemented a cyber security program to assess, identify, and manage risks from cyber security threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. This program has been integrated into the Company's overall risk management process.


text: We also utilize third-party service providers as a normal part of our business operations. These third-party service providers may have access to our systems and/or sensitive information. To address cybersecurity risks arising from our third-party service providers, we assess and monitor risks relating to potential compromises of sensitive information at our third-party service providers and reevaluate these risks periodically. We categorize our third-party service providers by criticality, based on the criticality and sensitivity of our data each third-party service provider has access to, and, based on this, we employ a risk-based approach for review of the security measures implemented by our third-party service providers. In addition, we obtain periodic attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.


text: Our business operations and relationships with customers and suppliers are heavily reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business. For example, we collect, store and transmit sensitive information including intellectual property, proprietary business information, including highly sensitive clinical trial data, and personal information in connection with our business operations. The secure maintenance of this information is critical to our operations and business strategy. If this information was subject to a cybersecurity attack or unauthorized access or use, it could have a material adverse effect on our business and could expose us to potential legal consequences, liabilities, mitigation costs, and damage to our reputation. Managing cybersecurity incidents would also divert management's attention and resources from regular business operations.


text: While we have implemented measures to safeguard our operational and technology systems and have established a culture of monitoring and improvement, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. However, our management has determined that, during the period covered by this Annual Report on Form 10-K, no cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, operating results, or financial condition.


text: risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, there can be no guarantee that we will not be the subject of future successful threats or incidents. The Company has not been subject to any information security breach penalties or settlement payments.


text: We have established a disclosure committee, which consists of our chief executive officer, chief financial officer, and senior leaders from finance, legal, accounting, corporate communications, and investor relations, including, but not limited to, our Chief Legal Officer, CIO, CISO, chief accounting officer, controller and Chief Corporate Communications Officer. The disclosure committee is actively involved in the review and approval of the Company's SEC filings and has responsibility for considering the materiality of information for such filings and, on a timely basis, determining the disclosure of that information. The CISO briefs the disclosure committee, as necessary, on cybersecurity related matters, which includes information regarding our detection, prevention, mitigation, and remediation of cybersecurity incidents and monitoring of previously evaluated cybersecurity incidents for subsequent changes that might impact conclusions on materiality, and this information is presented to the nominating and corporate governance committee, as appropriate.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's Enterprise Risk Management Program ("ERMP"), and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERMP and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a systematic, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents if they should occur.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: Risk Management and Strategy As one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity is delegated to the Audit and Compliance Committee of the Board, which oversees the Company's entire ERMP, reporting up to the full board on a periodic basis. The Company's Chief Information Officer ("CIO"), the Chief Compliance Officer and other members of management regularly report to the Audit and Compliance Committee, with cybersecurity representing a standing meeting agenda topic. • Collaborative Approach: The Company has implemented a systematic, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, 24x7 security monitoring, and other controls which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Cybersecurity Risk Management and Strategy The Company relies on information systems and the data stored on them to conduct its operations. We have adopted and maintain a cybersecurity risk management program in accordance with our risk profile and business that is informed by and incorporates elements of industry standards.

companyName: Lifeward Ltd.

ticker: LFWD


text: • Incident Response and Recovery Planning: The Company has established and maintains systematic incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a periodic basis. • Third-Party Risk Management: The Company maintains a systematic, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory cybersecurity training for all personnel as a means to equip the Company's workforce with effective tools to recognize, address and communicate potential or actual threats to the Company's cybersecurity systems. Moreover, these trainings also allow Company personnel to remain up-to-date with evolving information security policies, standards, processes and best practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company has also engaged third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results and findings of these exercises are reported to the Audit and Compliance Committee, who in turn updates the Board as appropriate. Management will then evaluate such findings and, with input from the Audit and Compliance Committee, take the appropriate steps to adjust the Company's cybersecurity policies, standards, processes and practices, as may be applicable, to strengthen or address any weaknesses, gaps or findings as the case may be.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from the cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.


text: The Board has delegated their oversight of cybersecurity to the Company's Audit and Compliance Committee which oversees the entire ERMP process. As detailed above, cybersecurity is a standing agenda topic for the Audit and Compliance Committee which receives regular presentations and reports from the Company's CIO on cybersecurity risks, detection protocols, disaster recovery readiness, the threat environment, recent developments in the cybersecurity space (including known incidents affecting the Company or key Company suppliers), evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. Under the current cybersecurity framework, the Audit and Compliance Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident. The Audit and Compliance Committee will keep the full board informed, as may be appropriate, until any such threat has been addressed to their satisfaction. Additionally, cybersecurity is also a standing agenda topic for the Global Risk Committee, with periodic updates to the Executive Committee and Senior Leadership Team.


text: The CIO, in coordination with the Chief Executive Officer, Chief Financial Officer, Chief Compliance Officer, Chief Legal Officer, and Chief People Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The CIO has served in various leadership roles in information technology and information security for over 24 years, including serving as the vice president of information technology, with direct responsibility over the cyber security program, for a large publicly-traded company and as the chief information security officer of several large healthcare organizations. The CIO holds a Certified Information Systems Security Professional certification, an undergraduate degree in engineering, an MBA and a PhD in engineering.


text: Cyber security risk is an area of increasing focus for our Board, particularly as an increasingly significant part of our operations rely on digital technologies. As a result, we have implemented a cyber security program to assess, identify, and manage risks from cyber security threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. This program has been integrated into the Company's overall risk management process.


text: The Board has delegated their oversight of cybersecurity to the Company's Audit and Compliance Committee which oversees the entire ERMP process. As detailed above, cybersecurity is a standing agenda topic for the Audit and Compliance Committee which receives regular presentations and reports from the Company's CIO on cybersecurity risks, detection protocols, disaster recovery readiness, the threat environment, recent developments in the cybersecurity space (including known incidents affecting the Company or key Company suppliers), evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. Under the current cybersecurity framework, the Audit and Compliance Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident. The Audit and Compliance Committee will keep the full board informed, as may be appropriate, until any such threat has been addressed to their satisfaction. Additionally, cybersecurity is also a standing agenda topic for the Global Risk Committee, with periodic updates to the Executive Committee.


text: The CIO, in coordination with the Chief Executive Officer, Chief Financial Officer, Chief Compliance Officer, Chief Legal Officer, and Chief People Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams, comprised of our cybersecurity experts, are deployed throughout the Company to identify and address cybersecurity threats and to respond to cybersecurity incidents. The CIO has served in various leadership roles in information technology and information security for over 24 years, including serving as the vice president of information technology, with direct responsibility over the cyber security program, for a large publicly-traded company and as the chief information security officer of several large healthcare organizations. The CIO holds a Certified Information Systems Security Professional certification, an undergraduate degree in engineering, an MBA and a PhD in engineering.


text: Management and Strategy we follow IoT cybersecurity standards and regulations, our products and information systems are potentially subject to cyber risks of data leakage and operational damages. To protect our products and information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, annual cyber testing, internal auditing, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. Any reported vulnerability is analyzed and reported to the CISO.


text: of our program to mitigate risk from cyber security threats, the Company actively evaluates and refines its cyber security tools and processes with the intention of reducing cyber security risks and aligning with the National Institute of Standards and Technology Cyber-security Framework for risk management. Features of our cybersecurity program include: Processes designed to comply with information security standards and privacy regulations, including the European Union's General Data Protection Regulation. Management Standard certification. Implementation of a variety of security controls, such as firewalls, and intrusion detection systems. Protection against Denial-of-Service attacks which prevent legitimate use of our services. Security events monitoring in our security operations center. Development of incident response policies and procedures designed to initiate remediation and compliance activities in a timely manner. Implementation of data loss prevention tools. Implementing an ID management system to enforce granular role-based access controls. Performing penetration testing on cloud and app platform. Administration of a comprehensive cyber security awareness program to educate employees about cyber security risks and best practices. Retention of a third-party, independent cyber security firm to conduct cyber security assessments of our systems and procedures.


text: Employment of a responsible disclosure policy, which includes a Bug Bounty Program designed to help identify and fix any potential flaws in the company's services or products.


text: employ processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, or customer, or otherwise implicating the third-party technology and systems we use. Such security measures include, without limitation: A security solution designed to safeguard customer data and systems. Security assessments of our major vendors. Risk assessments by an insurance company.


text: Implementation of endpoint detection and response (EDR) technology, as well as partial operational technology (OT) security measures on some of our factories, to protect our on-premises systems.


text: Board has delegated primary oversight of the Company's risks from cyber security threats to the Technology Committee. Our management team, including our Chief Information Security Officer (CISO), provides quarterly updates to our Technology Committee and annually to the full Board regarding our cyber security activities and other developments impacting our digital security. We have protocols by which certain cyber security incidents are escalated within the Company and, where appropriate, reported to the Board and Technology Committee in a timely manner.


text: management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security as a result of 26 years of experience in leading security teams, developing security strategies, and managing risk across various industries. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from a number of experienced information security officers responsible for various parts of the business and regularly reviewing risk management measures implemented by the Company to identify and mitigate cyber security risks.


text: Company's internal auditor and CISO are informed in the event of any significant cyber security incident and operate to comply with applicable laws regulations.


text: cyber security incident could materially affect our operations and production, including our ability to produce goods or provide services and our ability to timely and accurately produce financial reports. Further a cyber security incident could result in unauthorized access or disclosure of sensitive data, such as financial information, intellectual property, or customer, employee or supplier related data, including personally identifiable information. A material cyber incident could adversely affect our financial condition and results of operations, have as an adverse effect on our reputation and could result in legal actions against the Company. Please see the discussion under " Any unauthorized access to, disclosure, or theft of personal information we gather, store, or use could harm our reputation and subject us to claims or litigation." and "Third parties, our employees, or our vendors might gain unauthorized access to our network or seek to compromise our products and services" in Item 1A. Risk Factors for additional information.


text: Governance Related to Cybersecurity Risks Our Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management may provide periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.

companyName: Pioneer Green Farms, Inc.


text: Our cybersecurity risk management program incorporates multiple components, including, but not limited to, ongoing monitoring of critical risks from cybersecurity threats using automated tools. Additionally, we have implemented an employee education and training program, which we provide on an annual basis, that is designed to raise awareness of cybersecurity threats. To support our cybersecurity risk management program, we leverage managed service providers and other third-party information technology and cybersecurity providers and consultants, including to perform regular system scans and threat intelligence analysis. Additionally, we require certain third-party providers and consultants to adhere to contractual requirements relating to privacy and cybersecurity standards.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Governance


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, in the event of a cybersecurity incident, incident response strategies from our Chief Financial Officer ("CFO"). The audit committee updates the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.


text: Our Chief Technology Officer ("CTO"), who reports directly to our Vice President of Finance and, ultimately, our Chief Financial Officer, is responsible for the day-to-day management of our cybersecurity risk management program. The individual currently serving in this position is a third-party consultant who maintains 20 years of experience advising similarly situated companies on information technology and cybersecurity risk management. Our CTO provides regular cybersecurity updates to our Vice President of Finance and Chief Financial Officer on matters relating to our cybersecurity program and cybersecurity risk management.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. Our IT policies, processes and practices are based on recognized frameworks established by our external IT service provider and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As part of the above processes, we regularly engage consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. EDR System (Endpoint Detection & Response)


text: Two-factor authentication for email (Office 365) and cloud-stored information We protect our mail system against spam, phishing, spoofing, and malware using a (Mail Relay system). Additionally, we enforce a real-time threat notification mechanism and activate alerts and reports for failures in our backup system.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. We also describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are increasingly dependent on information technology systems, infrastructure and data, and our internal computer systems, or those of our collaborators, third-party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: Our cybersecurity program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. To this end, we have implemented a cybersecurity program that includes the following elements: A Cybersecurity Manager responsible for developing and maintaining our administrative, technical, and physical cybersecurity controls. Risk assessments designed to identify material cybersecurity risks to our critical systems and information. A Security Operations Center (SOC) to monitor our critical infrastructure and execute immediate, human-led responses to confirmed threats. External technology and security providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity program.


text: Cybersecurity awareness training for employees and supplemental training for senior management and other personnel who access highly sensitive information A third-party risk management process and questionnaire for service providers and vendors who access sensitive information. A trained incident response team and written procedures to navigate the incident response lifecycle.


text: Based on the information that we have to date, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected, including our operations, business strategy, results of operations, or financial condition. and, as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. There can be no guarantee that our policies, programs and controls, and those of our third-party vendors, including those described in this section, will be sufficient to protect our information, information systems or other property. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information.


text: Risk Management and Strategy While we follow IoT cybersecurity standards and regulations, our products and information systems are potentially subject to cyber risks of data leakage and operational damages. To protect our products and information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, annual cyber testing, internal auditing, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. Any reported vulnerability is analyzed and reported to our Chief Information Security Officer ("CISO").


text: As part of our program to mitigate risk from cyber security threats, the Company actively evaluates and refines its cyber security tools and processes with the intention of reducing cyber security risks and aligning with the National Institute of Standards and Technology Cyber-security Framework for risk management. Features of our cybersecurity program include: Processes designed to comply with information security standards and privacy regulations, including the European Union's General Data Protection Regulation. Maintenance of an ISO 27001 Information Security Management Standard certification. Implementation of a variety of security controls, such as firewalls, and intrusion detection systems. Protection against Denial-of-Service attacks which prevent legitimate use of our services. Security events monitoring in our security operations center. Development of incident response policies and procedures designed to initiate remediation and compliance activities in a timely manner. Implementation of data loss prevention tools. Implementing an ID management system to enforce granular role-based access controls. Performing penetration testing on cloud and app platform. Administration of a comprehensive cyber security awareness program to educate employees about cyber security risks and best practices. Retention of a third-party, independent cyber security firm to conduct cyber security assessments of our systems and procedures.


text: Employment of a responsible disclosure policy, which includes a Bug Bounty Program designed to help identify and fix any potential flaws in the company's services or products.


text: Third Party Cybersecurity Oversight We have implemented governance processes designed to monitor, evaluate, and mitigate security risks that may arise from a relationship with a third party vendor, partner, or customer. These security measures include: Vendor security assessments - Evaluating the cybersecurity protection that key vendors employ, prior to and during engagement. Insurance risk assessments - conducted by our insurance providers in order to evaluate cybersecurity related exposure. Operational Technology Security - Implementing security measures within some of our manufacturing facilities to enhance our cybersecurity protection. Secure customer data management - Solutions designed to safeguard customer data and critical systems.


text: We engaged a well-known external firm to audit our compliance with the European Union's NIS 2.0 Directive (the Directive on Security of Network and Information Systems). This audit is being conducted to confirm that our cybersecurity practices align with the latest regulatory requirements and best practices for managing the security of critical infrastructure and services. The Technology Committee receives periodic reports from management on our cybersecurity program and risks. In addition, management updates the Technology Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Technology Committee reports to our Board regarding its risk management functions, including those related to cybersecurity.


text: Governance & Oversight The Board has delegated primary oversight of the Company's risks from cybersecurity threats to the Technology Committee. Our management team, including our CISO, provides quarterly updates to our Technology Committee and annually to the full Board regarding our cyber security activities and other developments impacting our digital security. We have protocols by which certain cyber security incidents are escalated within the Company and, where appropriate, reported to the Board and Technology Committee in a timely manner.


text: At the management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security as a result of 27 years of experience in leading security teams, developing security strategies, and managing risk across various industries. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from a number of experienced information security officers responsible for various parts of the business and regularly reviewing risk management measures implemented by the Company to identify and mitigate cyber security risks.


text: Cybersecurity Risk Management and Strategy We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program in accordance with our risk profile and business that is informed by and incorporates elements of industry standards.


text: Our cybersecurity risk management program incorporates multiple components, including, but not limited to, ongoing monitoring of critical risks from cybersecurity threats using automated tools. Additionally, we have implemented an employee education and training program, which we provide on an annual basis, that is designed to raise awareness of cybersecurity threats. To support our cybersecurity risk management program, we leverage managed service providers and other third-party information technology and cybersecurity providers and consultants, including to perform regular system scans and threat intelligence analysis. Additionally, we require certain third-party providers and consultants to adhere to contractual requirements relating to privacy and cybersecurity standards.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, from time to time we and our third-party vendors have experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors - Risks Related to Our Intellectual Property and Information Technology" in this Annual Report on Form 10-K.


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, in the event of a cybersecurity incident, incident response strategies from our Chief Financial Officer. The audit committee updates the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.


text: Our Chief Technology Officer ("CTO"), who reports directly to our Vice President of Finance and, ultimately, our Chief Financial Officer, is responsible for the day-to-day management of our cybersecurity risk management program. The individual currently serving in this position is a third-party consultant who maintains 20 years of experience advising similarly situated companies on information technology and cybersecurity risk management. Our CTO provides regular cybersecurity updates to our Vice President of Finance and Chief Financial Officer on matters relating to our cybersecurity program and cybersecurity risk management.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. Our IT policies, processes and practices are based on recognized frameworks established by our external IT service provider and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As part of the above processes, we regularly engage consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. EDR System (Endpoint Detection & Response)


text: Two-factor authentication for email (Office 365) and cloud-stored information We protect our mail system against spam, phishing, spoofing, and malware using a (Mail Relay system). Additionally, we enforce a real-time threat notification mechanism and activate alerts and reports for failures in our backup system.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. We also describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are increasingly dependent on information technology systems, infrastructure and data, and our internal computer systems, or those of our collaborators, third-party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs." included as part of our risk factor disclosures at Item 1A of this Annual Report.


text: Our Audit Committee of the Board of Directors ("the Audit Committee"), is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: CYBERSECURITY RISK MANAGEMENT, GOVERNANCE AND RISK ASSESSMENT The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company has established a cybersecurity program (the "Program") that is designed to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: CYBERSECURITY RISK MANAGEMENT The Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST Special Publication 800-53, and the Payment Card Industry standards, as applicable, and designed to comply with applicable laws and regulations, including HIPAA and the New York Department of Financial Services Cybersecurity Regulation, as applicable. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and Payment Card Industry standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. The Program is aligned with the Company's overall enterprise risk management system and processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Control procedures are assessed regularly to confirm their effectiveness. The Company undergoes an annual Service Organization Controls ("SOC") Type 2 attestation report covering the performance of safeguards deployed to protect certain Company systems and applications. The Company maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.