text: Risk Management and Strategy Under the oversight of our Executive Security Council, which is chaired by our Senior Vice President of Technology (Certified Information Systems Security Professional), and is also comprised of our Chief Legal Officer, Chief Operating Officer, Chief Accounting Officer and Treasurer and Chief Financial Officer, we have developed and implemented a cybersecurity risk management governance, risk, and compliance ("GRC") program that applies to us as well as our advisor and its affiliates. Our GRC program is used to identify, assess, and mitigate findings and risks to our operations from cybersecurity threats. Our GRC program employs qualitative and quantitative assessments of the cybersecurity risk landscape impacting our operations, as identified by our Information Technology ("IT") and Security team, to determine likelihood and potential impact. The analysis is evaluated by our Executive Security Council, and subject to the oversight of our board of directors to assess and prioritize potential risk to our information security. We consider cybersecurity, along with other top risks, within our enterprise risk management and GRC framework.


text: We have established a multilayer cyber threat defense program that enables us to identify, protect, detect, respond, and recover from cyber threat findings, taking appropriate action to prevent these threats from turning into risk. Part of this security program is an incident response plan, the goal of which is to provide a timely response, mitigate any damage, restore services, preserve evidence, evaluate risk impact, communicate effectively to all stakeholders, and ultimately reduce the likelihood of an incident recurrence through proper containment and retrospective.

companyName: Cottonwood Communities, Inc.

secItem: Item 1C


text: We engage third-party consultants to conduct cybersecurity assessments and help mature the information security program. We regularly review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our board of directors, and we may adjust our cybersecurity program and practices as necessary based on the information provided by these assessments, audits and reviews. We review and test our information security systems, including regular penetration tests of our network. We also use third-party systems to monitor our information security continually.

stage1Category: Risk Management Process

stage1Method: unanimous


text: For any of our critical hosted applications we require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, or the report is qualified, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: We regularly evaluate our overall security risk posture to ensure appropriate security controls are in place to ensure confidentiality, integrity, and availability of the firms processing environment, including our business strategy, results of operations or financial condition, to ensure that we have an appropriate security program in place in order to manage materiality. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information, see " Item 1A. Risk Factors – Breaches of our data security could materially harm us, including our business, financial performance and reputation."

stage1Category: Strategy Integration


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Executive Security Council periodically reports to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment, and programs in place to address and mitigate the risks associated with the evolving cybersecurity threat landscape. These reports also include updates on our preparedness, prevention, detection, responsiveness, and recovery with respect to any cybersecurity incidents. Material cybersecurity events, if any, are escalated to our full board of directors on an ongoing basis as necessary.


text: Our Executive Security Council governs our overall cybersecurity function and is responsible for developing and implementing our information risk program and managing our response to threats in collaboration with our IT and Security team, subject to oversight by our board of directors. Our Executive Security Council meets regularly regarding the risks of any cybersecurity incidents which are reported pursuant to (i) criteria set forth in our information risk program, (ii) notification criteria set forth in our contracts with third-party service providers and (iii) reports prepared by consultants, auditors, and other third parties retained by us, if necessary, to investigate cybersecurity incidents. In addition to our in-house cybersecurity capabilities, at times we also engage third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of our IT and Security team, including the third-party security firms we utilize as part of our program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: Our Senior Vice President of Technology's relevant cybersecurity expertise includes Certified Information Systems Security Professional ("CISSP") designation, ISO 27001 as well as over 20 years of experience as a technology and security professional.

stage1Category: Management Role

stage1Method: majority


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere through our service agreements with them, as further discussed in Note 13—Related Party Transactions of our Notes to Consolidated Financial Statements, and Cheniere's board of directors (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.

companyName: Cheniere Corpus Christi Holdings, LLC

stage1Category: Board Governance


text: Risk Management and Strategy As part of its broader approach to risk management, Cheniere's cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Cheniere's strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, Cheniere routinely evaluates opportunities to refine its cybersecurity program in order to mitigate operational network risks. Cheniere includes business continuity planning as a component of its strategy to help ensure critical systems are available to support the Company in the instance of a disruptive event. Cheniere also participates in various industry organizations to stay abreast of recent trends and developments.


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems, and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere strives to contractually require third party service providers with access to its information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to them, except as required by applicable law. Cheniere also strives to negotiate contractual requirements which compel its service providers to notify them of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.


text: During the year ended December 31, 2023, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer ("CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Cheniere's CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.


text: Risks that could affect us are an integral part of Cheniere's Board and Audit Committee deliberations throughout the year. Cybersecurity risks are integrated into Cheniere's enterprise risk assessment process, which is reviewed by Cheniere's Board at least annually. Cheniere's Board has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while Cheniere's Audit Committee has been delegated the authority to oversee and periodically review the security of Cheniere's information technology systems and controls, including programs and defenses against cybersecurity threats. Cheniere's Audit Committee discusses with Cheniere's management its cybersecurity risk exposures and the steps Cheniere's management has taken to mitigate such exposures, including its risk assessment and risk management policies. On a quarterly basis, Cheniere's cybersecurity leadership team updates Cheniere's Audit Committee on the overall status of its cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.


text: We are dedicated to continuous improvement in our cybersecurity program. We regularly monitor, evaluate, and aim to enhance our capabilities through investments in technology, infrastructure, and personnel. Our goal is to try to stay ahead of emerging threats and maintain the highest level of cybersecurity resilience.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third party pipelines which supply the Liquefaction Project, could negatively impact our operations, result in data security breaches, impede the processing of transactions or delay financial or compliance reporting under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere through our service agreements with them, as further discussed in Note 11—Related Party Transactions of our Notes to Consolidated Financial Statements, and Cheniere's board of directors (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: During the year ended December 31, 2024, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third parties with whom we do business, including pipelines which supply our Liquefaction Project, or an attack on our critical suppliers, could negatively impact our business or operations, result in data security breaches, impede the processing of transactions, delay financial or compliance reporting and potentially harm our reputation under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Liberty Energy Inc.

ticker: LBRT

stage1Category: None/Other


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide practice of cybersecurity risk management. This integration ensures that cybersecurity considerations are part of our decision-making processes. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to identify, assess, and manage material risks from cybersecurity threats. As part of our cybersecurity risk management process, we have conducted simulated cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cyber incident preparedness.


text: Engagement of Third-Parties Recognizing the complexity and evolving nature of cybersecurity threats, we may periodically engage a range of external experts, including cybersecurity assessors, consultants, and auditors to evaluate and test our information systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes generally follow industry-recognized standards and frameworks, and are compliant with applicable laws.


text: Oversight of Third-Party Risk Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct security assessments of critical third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes regular assessments by our Chief Information Officer ("CIO") and cybersecurity staff and advisors. This approach is designed to mitigate risks related to data breaches or other security incidents involving third-parties.

stage1Category: Third-Party Risk


text: Risks from Cybersecurity Threats We have experienced, and may in the future experience, directly or indirectly through our third-party service providers, cybersecurity incidents. While prior cybersecurity incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations, and financial condition. For more information about the cybersecurity risks we face, see "We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss" in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Board of Directors Oversight Our Board of Directors has designated the Audit Committee to oversee risk management associated with cybersecurity threats. The Audit Committee is comprised of board members with diverse expertise including risk management, technology, and finance, which we believe enables them to oversee cybersecurity risks.


text: Management's Role We have a cybersecurity risk management committee comprised of senior leadership, including our CIO. The committee evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. The Company's cybersecurity risk management committee is also responsible for informing the Audit Committee on cybersecurity risks. The committee provides briefings to the Audit Committee on at least a quarterly basis, performs a comprehensive annual review of cybersecurity risks and threats, and assesses and adjusts the Company's processes to prevent, detect, mitigate, and remediate any such risks and threats.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO. With over 30 years of experience in the field of information systems and cybersecurity, our CIO brings a wealth of expertise to this role. His background includes extensive experience as an enterprise CIO and his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program as such items relate to cybersecurity. Our CIO manages our cybersecurity risks with the help of key personnel overseeing cybersecurity, information technology networks and infrastructure, operational technology, and critical software applications.


text: Our CIO and information technology team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CIO and information technology team implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO and information technology team are equipped with a well-defined incident response plan, which includes escalation to the cybersecurity risk management committee and the Audit Committee, and relevant public disclosure, as appropriate.


text: Board of Directors Oversight Our Board of Directors (the "Board") has designated the Audit Committee to oversee risk management associated with cybersecurity threats. The Audit Committee is comprised of board members with diverse expertise including risk management, technology, and finance, which we believe enables them to oversee cybersecurity risks.


text: Risk Management and Strategy We depend on IT and OT for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, point-of-sale processing at our retail sites, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.

companyName: Delek US Holdings, Inc.

ticker: DK


text: Managing Third Party Risk There are risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information. We evaluate third-party service providers' cybersecurity posture and seek to mitigate risk through contractual safeguards, monitoring, and incident response plans.

companyName: Cactus, Inc.

ticker: WHD


text: We established a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the Board of Directors. Our Chief Technology Officer & Digital Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. Delek follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: Our risk assessment process related to cybersecurity includes identifying threats and conducting vulnerability assessments, likelihood and impact assessments related to our own information and OT systems as well as our third-party service providers. Delek collaborates with third-party vendors to leverage managed security services, enhancing Delek's cybersecurity capabilities. Delek possesses monitoring capabilities for both its IT and OT infrastructure. To identify material cybersecurity risks, we use a combination of technical assessments, risk analysis, vulnerability scanning, incident and event monitoring, threat intelligence and third-party assessments along with ongoing monitoring and management.


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. Delek has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, Delek has increased the frequency and sophistication of the mandatory training and phishing campaign program for our employees. Delek also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. Delek is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the two drills conducted in 2023, we are dedicated to continuous improvement and proactive readiness in addressing potential challenges and ensuring the effective management of incidents.


text: Delek has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2023, 2022 and 2021. Delek continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.


text: Board of Directors Oversight The Board of Directors and executive leadership team at Delek are committed to investing the attention and resources necessary to maintain the privacy, security and integrity of our information, systems and networks and enhance the company's resiliency against cyber threats. To assist in these efforts, the Board of Directors has assigned a number of cybersecurity related responsibilities to its standing committees while retaining overall responsibility for the oversight of Delek's cybersecurity activities.


text: In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Company programs are discussed with the Board of Directors by the Chief Technology & Digital Officer Chief Information Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: In 2021 the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Company's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Company's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Company's digitalization, information and operational security policies help ensure strategic alignment of the Company's strategies with information security and risk management.


text: In 2021, the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Company's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Company's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Company's digitalization, information and operational security policies help ensure strategic alignment of the Company's strategies with information security and risk management.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Digital Officer/Chief Information Officer reports to the Chief Executive Officer, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Digital Officer/Chief Information Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Digital Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Company. Senior leadership including our Chief Technology & Digital Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: Risk Management and Strategy We depend on IT and OT for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.


text: We maintain and continually enhance a comprehensive, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the Board of Directors. Our Chief Technology & Data Officer holds overall responsibility for IT, OT, and cybersecurity. Delek follows recognized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. Delek has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention designed to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, Delek conducts mandatory security awareness programs, including required training and phishing campaigns for our employees. Delek also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. Delek is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the drill conducted in 2024 and previous years, we remain committed to continuous improvement and proactive preparedness in addressing potential challenges and effectively managing incidents.


text: Delek has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for the years ended December 31, 2024, 2023 and 2022. Delek continuously assesses and enhances the confidentiality, integrity, and availability of its IT and OT assets.


text: In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Company programs are discussed with the Board of Directors by the Chief Technology & Data Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, providing oversight of cybersecurity risks at the highest levels of our organization. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Data Officer reports to the Chief Executive Officer, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Data Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Our Chief Technology & Data Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Company. Senior leadership including our Chief Technology & Data Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks In the normal course of business, we collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third party information and employee information, and certain personal identifiable information. To manage the risks associated with cybersecurity threats, we are continually assessing, reviewing and adopting new processes, systems and resources in an effort to protect the information in our possession. We have endeavored to implement policies, standards, and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment:

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Regular assessments of our cybersecurity safeguards are conducted periodically. Management conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and protection software, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. We also incorporate external resources to aid in reviews of our cybersecurity program.


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct periodic incident response tabletop exercises and planned incident response drills to refine and update incident response processes.


text: All employees and contractors are required to receive bi-annual cybersecurity awareness training, and have deployed internal phishing campaigns to measure the effectiveness of the training program. New hires also receive training in response to drills and simulated attacks.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.


text: We recognize that third-party service providers introduce cybersecurity risks to our business. In an effort to mitigate these risks, before engaging with any third-party service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to security standards and protocols, as applicable.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management activities. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains and recognize cybersecurity measures have become more critical due to remote work, and we continuously evaluate improvements and new measures to protect our information and computing systems. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security or eliminate all risks associated with cyberattacks to us or third parties with whom we do business. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats and Management's Role The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity, information security and information technology risks, as well as management's actions to identify, assess, mitigate and remediate those risks. The Audit Committee assists our Board of Directors in exercising oversight of the Company's cybersecurity, information security and information technology risks. At least annually, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Administrative Officer ("CAO") is responsible for upward reporting of emerging cybersecurity incidents to our Audit Committee, who in turn reports to our Board of Directors.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, our Board of Directors considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our CAO meets regularly with management to proactively review current cybersecurity threats as well as our potential exposure. Our CAO, supported by members of our management team and information technology group, briefs the Audit Committee on cybersecurity matters as needed and holds discussions on cybersecurity risks, incident trends and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks The security and integrity of our information and operational technology infrastructure is critical to our business and our ability to perform day-to-day operations and deliver services. In the normal course of business, we collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third party information and employee information, and certain personal identifiable information. To manage the risks associated with cybersecurity threats, we are continually assessing, reviewing and adopting new processes, systems and resources in an effort to protect our operations and the information in our possession. We have endeavored to implement policies, standards, and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment:


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Assessments of our cybersecurity safeguards are conducted periodically. Management conducts periodic evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies and education programs in response. We use firewalls and protection software, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. We also incorporate external resources to aid in reviews of our cybersecurity program.


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We aim to conduct periodic incident response tabletop exercises and planned incident response drills to refine and update incident response processes.


text: All employees and contractors are required to receive bi-annual cybersecurity awareness training, and have deployed internal phishing campaigns to measure the effectiveness of the training program. New hires are also required to receive training in the form of drills and simulated attacks.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company systems.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, though we and the third parties with whom we do business have experienced certain cybersecurity incidents, we are not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains and recognize cybersecurity measures have become more critical due to remote work, and we continuously evaluate improvements and new measures to protect our information and computing systems. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security or eliminate all risks associated with cyberattacks on us or third parties with whom we do business. No security measure is infallible. See Part I, Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats and Management's Role The Audit Committee of our board of directors is responsible for overseeing cybersecurity, information security and information and operational technology risks, as well as management's actions to identify, assess, mitigate and remediate those risks. The Audit Committee assists our board of directors in exercising oversight of the Company's cybersecurity, information security and information and operational technology risks. At least annually, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Administrative Officer ("CAO") is responsible for upward reporting of significant cybersecurity incidents to our Audit Committee, who in turn reports to our board of directors, as appropriate.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, our Board of Directors considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our CAO meets regularly with the Information Technology department ("IT department") which includes individuals who possess extensive experience in information technology and cybersecurity. The IT department reports directly to the CAO and is responsible for managing the Company's cybersecurity initiatives, including technical risk assessments, implementation of controls, and response to cybersecurity incidents. The IT department has significant expertise in IT systems and cybersecurity, enabling the Company to respond effectively to cybersecurity risks and incidents.


text: Our management recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our employees and investors. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our systems. Our current processes are limited and reflect the transitional state of our business and lack of resources. If and when our business evolves and we obtain additional resources, we would expect to adapt our processes accordingly.

companyName: EXICURE, INC.

ticker: XCUR


text: Technical safeguards We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls.


text: We do not currently engage third parties with respect to our cybersecurity risk management processes due to our limited resources and operations.


text: Governance of Cybersecurity Risks Pursuant to its charter, the Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Company's Chief Executive Officer, President, and Chief Financial Officer are responsible for assessing and managing cybersecurity risks. Given our currently limited resources, we do not have dedicated personnel with specific cybersecurity expertise. When appropriate, the Company's management will report on cybersecurity issues and presents information to our Audit Committee and/or our full Board on cybersecurity matters.


text: Material Impact of Cybersecurity Risks We have not experienced a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Risk Management and Strategy The Company has a robust, risk-based cybersecurity program, designed to protect the company's data as well as data belonging to its customers and partners. In addition to performing its annual assessment of the overall cybersecurity risk as part of the Company's Enterprise Risk Assessment evaluation, Magnolia constantly assesses its cybersecurity risks by considering the likelihood of occurrence and the potential impact on the business. The risk identification process considers those common in the oil and gas industry and those that pertain to the technologies within the Company's applications and infrastructure.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: Magnolia has policies that govern many aspects of computer and data security, data backup, appropriate use, and incident management. In addition, there are several key risk mitigation processes and software tools in place to prevent, detect, and respond to cybersecurity attacks. Multi-factor authentication and privileged access are required to access the Company's network in order to protect internal data and ensure appropriate access. The Company utilizes security vulnerability scanning software and 24/7 monitoring to detect and prevent significant cybersecurity threats. Magnolia uses a leading email and spam filtering solution and requires mandatory security awareness training for all employees, which is reinforced through periodic simulated phishing tests.


text: The Company uses a sophisticated backup and recovery methodology that supports the replication of data across multiple secure data centers with the intent to prevent local and cloud backup data from accidental destruction and unavailability in the event of data loss or a major cyber event. Magnolia has a cybersecurity Incident Response Plan ("IRP") in place that was established to help protect the integrity, availability, and confidentiality of information, prevent loss of service, and adhere to industry best practices. The IRP is reviewed annually and specifies the process for identifying a cybersecurity incident, conducting the initial investigation, classifying incident severity, documenting and communicating information to the appropriate parties, responding to and remediating the incident, and ongoing training. In the event of a cybersecurity incident, the IRP would be initiated to inform management, the Audit Committee, and the board of directors. The Company also has contracted retainers with third party vendors in the event they are required to assist during a major cybersecurity incident.


text: Cybersecurity risks are an important subset of Magnolia's overall risk management process. The Company considers the complexity of and reliance on cyber-connected systems in its risk assessment and prioritization. Magnolia's information security management processes and controls are based upon industry leading frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Through recurring internal audits, controls are regularly reviewed, tested, and enhanced to promote best practices.


text: Magnolia engages third party consultants to benchmark its internal cybersecurity posture against the NIST CSF, perform external penetration tests, and facilitate simulated cyberattacks and incident responses. Additionally, third party service providers perform continuous managed detection and response activities. Security due diligence is performed when considering purchasing third party software and utilizing third party hosted providers. This evaluation considers the security architecture, confidentiality and criticality of data, as well as methods and practices used by third party vendors to encrypt, transmit, store, back up, and recover data.


text: The Audit Committee of the board of directors has oversight of the Company's risk management, including cybersecurity. The Company's senior officers, including its Vice President, Information Technology, are responsible for cybersecurity risk management and regularly communicate with the Audit Committee and the board of directors regarding risks and threats, including the status of current cybersecurity risk prevention and threat detection efforts. Magnolia's Vice President, Information Technology, is the primary individual responsible for assessing and managing cybersecurity risks. He has extensive experience managing information technology departments of oil and gas organizations. This includes responsibilities for securing the solutions, data, and infrastructure for both corporate and field operations technology. The Company's technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security.


text: The Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Please see "Risk Factors" in Item 1A in this Annual Report on Form 10-K for further discussion regarding the Company's cybersecurity risks.


text: Risk Management and Strategy The Company has a robust, risk-based cybersecurity program, designed to protect the Company's data as well as data belonging to its customers and partners. In addition to performing its annual assessment of the overall cybersecurity risk as part of the Company's Enterprise Risk Assessment evaluation, Magnolia constantly assesses its cybersecurity risks by considering the likelihood of occurrence and the potential impact on the business. The risk identification process considers those common in the oil and gas industry and those that pertain to the technologies within the Company's applications and infrastructure.


text: Magnolia has policies that govern many aspects of computer and data security, data backup, appropriate use, and incident management. In addition, there are several key risk mitigation processes and software tools in place to prevent, detect, and respond to cybersecurity attacks. Multi-factor authentication and privileged access are required to access the Company's network in order to protect internal data and ensure appropriate access. The Company utilizes security vulnerability scanning software and 24/7 monitoring in an effort to detect and prevent significant cybersecurity threats. Magnolia uses email and spam filtering and requires mandatory security awareness training for all employees, which is reinforced through periodic simulated phishing tests.


text: The Company uses a backup and recovery methodology that supports the replication of data across multiple secure data centers with the intent to prevent local and cloud backup data from accidental destruction and unavailability in the event of data loss or a major cyber event. Magnolia has a cybersecurity Incident Response Plan ("IRP") in place that was established to help protect the integrity, availability, and confidentiality of information, prevent loss of service, and adhere to industry best practices. The IRP is reviewed annually and specifies the process for identifying a cybersecurity incident, conducting the initial investigation, classifying incident severity, documenting and communicating information to the appropriate parties, responding to and remediating the incident, and ongoing training. In the event of a cybersecurity incident, the IRP would be initiated to inform management, the Audit Committee, and the board of directors, as necessary. The Company also has contracted retainers with third party vendors in the event they are required to assist during a major cybersecurity incident.


text: The Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Please see Item 1A—Risk Factors—Magnolia's business could be adversely affected by security threats, including cybersecurity threats, and related disruptions in this Annual Report on Form 10-K for further discussion regarding the Company's cybersecurity risks.


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. As a result, cybersecurity risk management is an integral part of our overall risk management and compliance program. Our cybersecurity risk management processes are modeled after industry best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed by third-party service providers, and facilitate coordination across different departments of our company.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: Use of Third Parties We have engaged, and intend to continue to engage, nationally recognized third parties to assist us in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.

companyName: Simply Good Foods Co

ticker: SMPL


text: The Board has overall oversight responsibility for our cybersecurity risk management; however, it delegates cybersecurity risk management oversight to the audit committee of the Board (the "Audit Committee"). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: These processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. Our information technology team is responsible for assessing our cybersecurity risk management program, and we currently do not engage third parties for such assessment.


text: Our cybersecurity program is under the direction of our Chief Financial Officer ("CFO") and our Chief Technology Officer ("CTO"), who receive reports from our information technology team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO has over 26 years of extensive information technology experience in various roles of increasing importance. His experience includes roles as Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst. Among his other duties as CTO, he manages our cybersecurity team, which comprises certified and experienced information security professionals, and he has been instrumental in the implementation and monitoring of our various cybersecurity systems and tools.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs, including: • Implementing a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner; • Deploying technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • Establishing and maintaining comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis; and • Providing regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Management, including the CFO, regularly updates the Audit Committee on our cybersecurity processes, material cybersecurity risks and mitigation strategies. The Audit Committee reports all material cybersecurity risks to the Board.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2023 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors — Our success depends on the security and integrity of the systems and products offered, and security breaches or other disruptions could compromise certain information and expose us to liability, which could cause our business and reputation to suffer."


text: These processes include steps for assessing the severity of a cybersecurity threat, identifying the root cause of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. Our information technology team is responsible for assessing our cybersecurity risk management program, and we currently do not engage third parties for such assessment.


text: Our cybersecurity program is under the direction of our Chief Financial Officer ("CFO") and our Chief Technology Officer ("CTO"), who receive reports from our information technology team and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO has over 27 years of extensive information technology experience in various roles of increasing importance. His experience includes roles as Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst. Among his other duties as CTO, he manages our cybersecurity team, which comprises certified and experienced information security professionals, and he has been instrumental in the implementation and monitoring of our various cybersecurity systems and tools.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2024 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors — Our success depends on the security and integrity of the systems and products offered, and security breaches or other disruptions could compromise certain information and expose us to liability, which could cause our business and reputation to suffer."


text: Risk Management and Strategy Given the importance of cybersecurity to our business, we maintain a cybersecurity program to help support the effectiveness of our systems and our preparedness for cybersecurity risks. Our program is informed by industry frameworks, such as the NIST Cybersecurity Framework, and comprises various components, including policies, procedures and protocols; threat monitoring and alerting; auditing and assessments; and other security controls and tools. We also require cybersecurity trainings when onboarding new employees and contractors, as well as annual cybersecurity awareness training for our employees and contractors.

companyName: GRAIL, Inc.

ticker: GRAL


text: We use various means, including our Enterprise Risk Management ("ERM") process, in an effort to assess and manage cybersecurity risks that may be associated with our systems, operations, and third-party service providers. We also are working towards enhancing our cybersecurity risk management practices and various other security controls following the Spin-Off, and have at times conducted internal audits and engaged external assessors to help review our cybersecurity program and identify opportunities for maturing our program. For additional information, see "Item 1A—Risk Factors".


text: Identifying, assessing and managing cybersecurity risks Our cybersecurity team and the owners of information technology systems across the business, led by our Chief Security Officer ("CSO"), monitor current events and trends related to cybersecurity in an effort to anticipate potential risks and threats on current systems and operations. We have implemented or are in the process of implementing various processes to identify, review and track risks to our systems and operations, including through the use of third-party solutions. We also seek to conduct due diligence in connection with the onboarding of new third-party vendors, and reviews are conducted on our critical third-party vendors. Following these assessments, we utilize the findings to improve and mature our cybersecurity practices and to promote continuous improvement. In addition, we have implemented a cybersecurity awareness program to train our employees and contractors on key cyber threats, which includes phishing exercises.


text: In the event of a cybersecurity incident, we have policies and processes for detecting threats and managing incident response. We also periodically conduct cross-functional exercises and activities to help detect, assess and respond to cybersecurity incidents, and have relationships with external providers to assist with incident response efforts, as needed. We also seek to contractually require our third-party service providers to notify us in the event a cybersecurity incident within their systems or services impacts our data or operations. We maintain specific coverage to help mitigate losses associated with certain cybersecurity incidents that impact our or our third parties' systems, networks and technology.


text: As of December 31, 2024, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company. While we maintain a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors".


text: Our Board of Directors administers its cybersecurity risk oversight function through its Audit Committee. The Audit Committee is charged with reviewing our cybersecurity and other information technology risks, controls, and procedures, including our plan to mitigate cybersecurity risks and respond to data or cybersecurity incidents. The Audit Committee is also charged with reviewing with management cybersecurity issues that could affect the adequacy of our internal controls. At least annually, the Audit Committee meets directly with the CSO and the executive leadership team and receives a report on our cybersecurity program, posture, risks and other matters. At least annually, we conduct an organization-wide ERM process to evaluate key risks in different areas of the business. Among those risks, cybersecurity risks are identified, and scores representing the potential likelihood and severity of each risk are determined. The executive leadership team and Audit Committee receive a direct report of the ERM program findings, including these cybersecurity risks. Third-party assessors, consultants, counsel or other parties also participate in Audit Committee discussions as needed.


text: More broadly, the Audit Committee reviews our policies and practices with respect to risk assessment and risk management, including results from our overall Enterprise Risk Management ("ERM"), and discusses with management our major financial risk exposures and the steps that have been taken to monitor and control such exposures. Cybersecurity is a key piece of our overall ERM program. The Audit Committee oversees the activities of, and meets regularly with, our Chief Compliance Officer, and receives direct reports from the Chief Compliance Officer regarding the ERM structure and activities of our compliance program, including updates on training, policies, auditing and monitoring, investigations and any corrective and preventive actions. As part of the ERM program, our Chief Compliance Officer gathers information about cybersecurity risk, and that information is included in the Chief Compliance Officer's report to the Audit Committee.


text: The CSO is responsible for implementing and overseeing the controls and processes employed to identify, assess and manage the Company's risks from cybersecurity threats. We also maintain a Privacy and Security Steering Committee that regularly meets to review and discuss cybersecurity issues and review our cybersecurity-related metrics. The Privacy and Security Steering Committee is comprised of the CSO and other representatives from our cybersecurity, IT, legal, and privacy teams. The CSO, cybersecurity team, and members of the Privacy and Security Steering Committee combined have decades of experience in managing relevant information technology and cybersecurity matters. The CSO also provides regular briefings to our executive leadership team, including the CEO and CFO, and our Audit Committee on cybersecurity matters, such as threats, events, and the state of the program, and at least annually as part of our ERM process. Our security program also includes a yearly audit of our controls towards cybersecurity certifications, including ISO 27001, SOC 2 Type 2, PCI DSS, UK Cyber Essentials, and others.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, protecting our stakeholders, and maintaining customer trust. Our approach to managing cybersecurity risks, which includes periodic risk assessments, implementing and overseeing governance and policies, an incident response plan, ongoing training and awareness programs, and a commitment to continuous improvement.


text: Our risk assessment process involves periodic vulnerability assessments and monitoring of emerging threats. Our policies and procedures are designed to ensure compliance with relevant regulations, to consider industry practices, and we periodically review and update them to address evolving cybersecurity risks.


text: In the event of a cybersecurity incident, we have an incident response plan in place. This plan includes detection, response, and communication with stakeholders. Incident response is supported by appropriate third-party experts to address, assess and respond to the event. The plan calls for the mobilization of a response team including both internal and external resources as well as communication protocols so that event information is shared on a proactive basis. We aim to prioritize transparency and accountability, and we are committed to providing timely and accurate information to our stakeholders in the event of a breach.


text: We understand the importance of educating our employees about cybersecurity risks, and, over the past two years have initiated awareness and training programs internally specifically targeted to employees with a goal of continually increasing employee education. This initiative aims to foster a culture of cybersecurity awareness and empower our employees to be vigilant in identifying and mitigating potential threats.


text: Our Vice President of Information Technology reports to the Company's Chief Financial Officer and is the head of the Company's cybersecurity team. This role is responsible for assessing and managing the Company's cyber risk management program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. Senior leadership has been specifically trained and is credentialed in cybersecurity risk assessment and oversight.


text: In conclusion, by prioritizing cybersecurity, we aim to protect the interests of our stakeholders, promote business continuity, and uphold the trust that our customers place in us. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, protecting our stakeholders, and maintaining customer trust. Our approach to managing cybersecurity risks, includes periodic risk assessments, implementing and overseeing governance and policies, an incident response plan, ongoing training and awareness programs, and a commitment to continuous improvement.


text: Our risk assessment process involves periodic vulnerability assessments and monitoring of emerging threats. Our policies and procedures are designed to ensure compliance with relevant regulations and to consider industry practices, and we periodically review and update them to address evolving cybersecurity risks.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Company's cyber risk management program, typically on an annual basis.


text: We are dedicated to continuous improvement in our cybersecurity program. We regularly monitor, evaluate, and aim to enhance our capabilities through investments in technology, infrastructure, and personnel. Our goal is to stay ahead of emerging threats and maintain the highest level of cybersecurity resilience.


text: We depend on information systems and related technologies for internal purposes, including secure data storage, processing, and transmission, as well as in our interactions with our business associates, such as customers and suppliers. We also rely on third-party business associates, with whom we may share data and services, to defend their digital technologies and services against attack.


text: Managing Material Risks & Integrated Overall Risk Management We attempt to integrate cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. We depend on various controls, policies, procedures and programs ("Risk Controls") to manage our risks, including risks associated with our information systems. Risks and Risk Controls are included as part of our annual enterprise risk management ("ERM") program. Our risk controls include our administrative, physical, and technical controls ("Cyber Risk Controls"). We are dependent on our Cyber Risk Controls to protect our information systems and the data that resides on or is transmitted through them. The Cyber Risk Controls are in many cases integrated with our other Risk Controls in an attempt to maximize their effectiveness.


text: Engaging Third Parties on Risk Management We collaborate with our clients, vendors and other third parties to develop information systems and protect against cybersecurity threats. We engage third-party security experts for risk assessments and program enhancements.


text: Risks from Cybersecurity Incidents While we have experienced and will likely continue to experience varying degrees of cyber incidents in the normal conduct of our business, including attacks resulting from phishing emails and ransomware infections, those incidents have not materially affected the Company's business strategy, results of operations, or financial condition. There can be no assurance that the systems we have designed to prevent or limit the effects of cyber incidents or attacks will be sufficient to prevent or detect future material consequences arising from incidents or attacks, or to avoid a material adverse impact on our systems after such incidents or attacks do occur. However, the Company does not currently anticipate that risks from cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Governance.


text: Risk Management Personnel Our Director of IT Infrastructure and Cybersecurity has direct responsibility for assessing, monitoring and managing risks related to cybersecurity threats in conjunction with the Vice President of Information Technology. Third party experts and/or consultants are retained to help identify, assess and monitor cybersecurity incidents and related risks. Our Director of IT Infrastructure and Cybersecurity has been in that position with the Company since 2019 and, including prior experience, has over 12 years' experience in managing IT infrastructure, architecture and security. Our Vice President of Information Technology has been with the Company in his current position and similar roles since its inception in 2011. Prior to joining the Company, he had over 20 years' experience in oversight of Information Technology systems including ERP systems, infrastructure, and networking.


text: Monitoring Cybersecurity Risks and Incidents Our Director of IT Infrastructure and Cybersecurity meets regularly with members of our executive team to discuss and review risks related to cybersecurity. The reviews may include evaluations of risks and incidents identified by third-party providers retained to review our cyber risk as well as cybersecurity threat scenario planning. Identified risks related to cybersecurity threats may also be analyzed as part of our ERM process.


text: Board of Director Oversight Our Audit Committee is responsible for oversight of our programs and procedures related to cybersecurity risk. Management provides periodic reports to the Audit Committee on cybersecurity risk. The Audit Committee reports significant findings from these reports to the full Board of Directors.


text: Managing Material Risks & Integrated Overall Risk Management We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. We depend on various controls, policies, procedures and programs ("Risk Controls") to manage our risks, including risks associated with our information systems. Risks Assessment and Risk Controls are included as part of our annual enterprise risk management ("ERM") program. Our risk controls include our administrative, physical, and technical controls ("Cyber Risk Controls"). We are dependent on our Cyber Risk Controls to protect our information systems and the data that resides on or is transmitted through them. The Cyber Risk Controls are in many cases integrated with our other Risk Controls in an attempt to maximize their effectiveness.


text: Managing Third Party Risk There are risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information. We evaluate third-party service providers' cybersecurity posture and seek to mitigate risk through contractual safeguards, monitoring, and incident response plans.


text: When risks or threats are identified to us by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our results of operations or financial condition. However, cybersecurity threats have the potential to significantly impair our operations and the operations of the various third parties upon whom we rely.

companyName: FONAR CORP

ticker: FONR


text: Risk Management Personnel Our Director of Cybersecurity and Networking has direct responsibility for assessing, monitoring and managing risks related to cybersecurity threats in conjunction with the Vice President of Information Technology. Third party experts and/or consultants are retained to help identify, assess and monitor cybersecurity incidents and related risks. Our Director of Cybersecurity and Networking has been in that position with the Company since 2019 and, including prior experience, has over 13 years' experience in managing IT infrastructure, architecture and security. Our Vice President of Information Technology has been with the Company in his current position and similar roles since its inception in 2011. Prior to joining the Company, he had over 20 years' experience in oversight of Information Technology systems including ERP systems, infrastructure, and networking.


text: Monitoring Cybersecurity Risks and Incidents Our Director of IT Cybersecurity and Networking meets regularly with members of our executive team to discuss and review risks related to cybersecurity. The reviews may include evaluations of risks and incidents identified by third-party providers retained to review our cyber risk as well as cybersecurity threat scenario planning. Identified risks related to cybersecurity threats may also be analyzed as part of our ERM process.


text: Risk Management and Strategy. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats. In conjunction with EBM, Inc., we employ best in class Endpoint Detection and Response with 24/7 SOC at the Endpoints. We also utilize MFA and Geolocation enforcement where available. We continuously monitor and maintain our network infrastructure including consistent vulnerability monitoring and remediation. We also engage in quarterly phishing campaigns as well as cybersecurity awareness training to our end users to keep them vigilant in being able to detect threats.

companyName: Azitra, Inc.

ticker: AZTR


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and patients, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Governance. Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third-party service providers. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.


text: We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a dedicated cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we operate a Cyber Fusion Center ("CFC") to monitor both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.

companyName: Baker Hughes Co

ticker: BKR


text: Use of Third Parties We have engaged, and intend to continue to engage, nationally recognized third parties to assist us in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We conduct regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.


text: Enterprise Risk Management Process Integration Cybersecurity risk management processes are an integral part of our enterprise risk management, which is overseen by the Audit Committee of the Board. Our processes include periodic program maturity assessments, ongoing information technology risk assessments, and third-party security risks assessments.


text: Our cybersecurity risk management efforts have also been integrated into the overall Enterprise Risk Management ("ERM") process, which includes assessment of cybersecurity risks that could result in significant operational disruption to the Company, such as production disruption, business downtime, loss of containment or other operation interruptions, as well as risks that could have significant reputational and compliance/regulatory impact. Cybersecurity risks identified and tracked through our ERM risk register have assigned risk owners at the executive leadership level and risk delegates who are responsible to identify and manage risk mitigation actions. Key risk indicators are updated quarterly by risk delegates and communicated to our executive leadership and the Audit Committee.


text: We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, and program enhancements. We also include cybersecurity training as part of our required annual employee training program. In addition, cybersecurity and privacy training and awareness is integrated and continues throughout the year, utilizing various delivery methods such as phishing campaigns, training sessions, and informational articles.


text: Third Party Security Experts We engage third party security experts to supplement our internal CFC team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: Identification of Threats Associated with Third Parties Baker Hughes utilizes a third-party risk management ("TPRM") program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. We conduct initial risk assessments of third-party suppliers and service providers based on various factors to classify each into a risk category. Our TPRM program is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of third-party suppliers and service providers that have access to Baker Hughes networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their cybersecurity controls. We track the identified deficiencies and include with other cybersecurity metrics based on their severity. We also require that our suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.


text: Incidents & Risks We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Technology Risks" identified in the "Risk Factors" section of Part 1 of Item 1A herein.


text: Board of Directors Oversight responsibilities for our cybersecurity and digital trust compliance programs and risks lie with the Audit Committee of the Board. The Board is actively engaged in the oversight of our cybersecurity program and oversees all operational, financial, strategic, and reputational risks with oversight of specific risks undertaken with the committee structure including risks related to cybersecurity, privacy, and technology.


text: When risks or threats are identified to us by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.


text: The Audit Committee receives reports on the Company's cybersecurity program and developments from our Chief Information Officer ("CIO"), who reports to the Chief Executive Officer, and our CISO, who reports to the CIO, at each of our regular meetings, which occur five times a year. These reports typically include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status, as well as a review of our third-party service providers. Our digital technology, legal, and the corporate audit functions also routinely present to the Audit Committee on key cybersecurity topics and, on at least an annual basis, the Board receives reports on the Company's cybersecurity program and developments from the CIO and CISO.


text: Our programs are focused on building digital trust through sound oversight of cybersecurity and data privacy protections and the responsible use of data and technology. We operate a CFC, and we have a cross-functional approach to addressing cybersecurity-related risks through the functional compliance structures in our digital technology and legal organizations with oversight from the corporate audit and controllership functions. The cybersecurity and legal functions employ full time cybersecurity and privacy roles with expertise in managing cybersecurity and privacy compliance and risks and responding to incidents.


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital trust compliance programs. The senior executive leadership-level Cybersecurity Steering Committee ("CSC") is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CSC also receives monthly reports on the Company's cybersecurity program and developments from our CISO and legal representatives. The CSC is chaired by our CISO. The senior executive leadership members include the CIO, Chief Legal Officer, Chief Financial Officer, Chief Compliance Officer, and Senior Vice President of Operations Excellence.


text: The CISO has over 25 years of business experience in information technology and cybersecurity and is a long-standing certified information systems security professional ("CISSP") with the International Information System Security Certification Consortium.


text: We have an Incident Response Team ("IRT") that consists primarily of representatives from the CFC, legal, corporate communications, finance, and other relevant stakeholders. The IRT follows the guidance as outlined in the IRP to respond to cybersecurity incidents and escalate as necessary to the CSC based on a defined severity matrix. Internal legal and finance stakeholders are responsible for assessing materiality of risks in consultation with the IRT, CSC, the CEO, and external advisors.