text: Our cybersecurity policies, standards, processes and practices are regularly assessed by external consultants and auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, for the last three years, we conducted an independent cyber security risk assessment to assess our cybersecurity maturity against the NIST cybersecurity framework. The results of significant assessments are reported to management and our Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments. For more information on our cybersecurity risks that may materially affect us, please refer to the section titled "Risk Factors – Security breaches of borrowers' confidential information that we store may harm our reputation, adversely affect our results of operations and expose us to liability – and – If our risk management framework does not effectively identify and control our risks, we could suffer unexpected losses or be adversely affected, which could have a material adverse effect on our business." While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner, which could result in substantial expenses and reputational damage.


text: Cybersecurity Governance Our Board of Directors and management are actively involved in the oversight of our risk management program, with cybersecurity representing a critical component to ensure alignment with our strategic objectives. The Audit Committee directly oversee and regularly review our cybersecurity program, receiving periodic reports from our Chief Information Security Officer ("CISO") on various matters including risk assessment results, progress of risk reduction initiatives, feedback from external auditors, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: OppFi Inc.

ticker: OPFI

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: While our Board of Directors has overall responsibility for the oversight of our enterprise-wide risk management, of which cybersecurity risk management is one component, our management team is responsible for day-to-day risk management, including the implementation of our cybersecurity program. We have established an information security council (the "Information Security Council"), with full participation from our senior management team, to serve as the steward of our information security program. Designed to meet quarterly or more frequently as needed, the council reviews security performance metrics, stays abreast of industry trends and regulatory changes, and evaluates progress on security initiatives. The council plays a crucial role in promoting a culture of security awareness and ensuring OppFi remains resilient against evolving cyber threats.

stage1Category: Management Role

stage1Method: majority


text: Our corporate information security organization manages and continually enhances a robust enterprise security structure with the goal of averting cybersecurity incidents while increasing our system resilience to minimize the business impact should an incident occur. Led by our CISO, who reports to the Chief Technology Officer ("CTO"), our corporate information security organization is composed of seasoned professionals, some holding certifications such as Certified Information Systems Security Professional or Certified Information Security Manager. Our CTO has served in various leadership roles in information technology for over 20 years, including a nine-year tenure as the Chief Technology Officer at a fintech company. He holds a bachelor's degree in computer engineering and a master's degree in information systems. Our CISO, with over 20 years of leadership experience in IT and security, was a CISO at a financial services company before joining OppFi. She has an MBA and a master's degree in Computer Information Systems and is a Certified Information Security Manager (CISM). Additionally, both the CISO and CTO are members of the Information Security Council, providing regular updates to our senior management team regarding our cybersecurity program, mitigation strategy, and progress.


text: Cybersecurity Risk Management and Strategy We confront substantial cybersecurity risks driven by various factors. These risks are rooted in the wide range of systems we must safeguard against cyberattacks, further exacerbated by the complexity and technical sophistication of our products and systems. Additionally, our reliance on third-party products, services, and components adds complexity to our risk landscape.


text: In response, we have adopted a cybersecurity program to manage cybersecurity risks, prioritizing the protection of data entrusted to us by our customers and other stakeholders. We employ various mechanisms, controls, technologies, and processes aimed at assessing, identifying, and managing these risks.


text: Our cybersecurity program is rooted in industry best practices, drawing upon frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization, and other relevant industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these standards as a guide to help us design and assess our program.


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program. Regular cybersecurity risk assessments are conducted, leveraging both internal and external sources of information to drive alignment on initiatives aimed at enhancing security controls. We maintain a cybersecurity incident response plan that identifies the activities and escalation processes to be implemented upon detection of a cybersecurity incident, and we regularly test and evaluate the effectiveness of such plan.


text: Technical safeguards undergo periodic assessment and enhancement designed to protect information systems from cybersecurity threats, utilizing vulnerability assessments, threat intelligence, and incident response experience. Our policies also mandate that our employees contribute to our security efforts. We regularly remind our employees of the importance of handling and protecting customer and employee data through quarterly security training and testing, aimed at enhancing employee awareness and improving their ability to detect and respond to cybersecurity threats.


text: Additionally, controls have been implemented that are designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Certain providers undergo security risk assessments upon onboarding and upon detection of an increase in their risk profile. Our risk assessments utilize various inputs, including information supplied by the providers and third parties. Furthermore, we mandate that our providers meet appropriate security requirements, controls, and responsibilities. We also investigate security incidents impacting our third-party providers as necessary.


text: Data Backup: Deployment of our new data backup system was completed in June 2024 and offers robust protection against catastrophic failures, early detection of data loss prevention events, and near real-time mitigation of ransomware attacks.

companyName: SES AI Corp

ticker: SES

stage1Category: Risk Management Process


text: Cybersecurity Risk Management and Strategy Information technology is important to our business operations and we are committed to protecting the privacy, security, and integrity of our data, as well as our employee, customer, and vendor data. Accordingly, we have established processes, procedures, and controls to identify, manage, assess, and mitigate material risks from cybersecurity threats, as well as identify, contain, and respond to cybersecurity incidents. These processes include, but are not limited to, monitoring and updating of our information technology and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses, and other events that could have a security impact. Additionally, to protect and secure sensitive data, we employ multi-factor authentication, a suite of security tools, systems monitoring and alerting, audit logs, and controls across our major systems, devices, and business processes. We engage with external experts to evaluate and test our cybersecurity risk preparedness. Regular exams and threat and security assessments with these third parties ensure that our cybersecurity strategies align with industry best practices. To manage cybersecurity risks associated with third-party service providers, we impose security requirements upon our suppliers, including maintaining an effective security management program and notifying us in the event of any known or suspected cyber incident. We also conduct company-wide security awareness training periodically to provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report the majority of suspicious activities or threats. We currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, or other related breaches.

companyName: AEye, Inc.

ticker: LIDR


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the risk factor within Item 1A "Risk Factors" in this Annual Report on Form 10-K, entitled "We, as well as our suppliers and partners, are subject to cybersecurity risks to operational systems, infrastructure, integrated software in our lidar solutions, and the data processed by those solutions, and any material failure, weakness, interruption, cyber event, incident, or breach of security could adversely affect our business by causing a disruption of our operations, a compromise or corruption of our confidential or other business-critical information, and/or damage our business relationships, all of which could negatively impact our business financial condition, and operating results."


text: Cybersecurity Governance Cybersecurity risks are among the enterprise risks that our Board of Directors oversees, primarily through delegation to the Audit Committee of the Board. The Audit Committee assists the Board in overseeing our privacy and information policies and reviewing our cybersecurity program. The Audit Committee engages with our management team, including our Director of IT and our Chief Financial Officer, and receives periodic reports on cybersecurity. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight. These cybersecurity reviews by the Audit Committee or Board of Directors generally occur at least once annually, or more frequently as determined to be necessary.


text: The day to day operations of our cybersecurity risk management program are overseen by our Director of IT, who reports to our Chief Financial Officer. Our Director of IT has served in this position for 5 years. He has over 38 years of IT experience, including over 10 years of experience in security compliance. Our Director of IT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, alerts, or reports produced by security tools deployed in the IT environment.


text: Cybersecurity is an important priority at SES, and we actively manage this critical risk through comprehensive measures. Our processes for assessing, identifying, and managing material risks from cybersecurity threats are still in development and have yet to be integrated into our overall risk management system and processes.


text: Michael Kraus, Vice President of Compliance and Information Technology, leads our information security program with his expertise, honed by over 30 years of experience in the high-tech industry designing and deploying high-performance communication networks. Mr. Kraus has global network building experience which we believe helps to bolster our security posture.


text: While cybersecurity threats remain a reality for all organizations, SES is committed to proactive risk management and continuous improvement in our security posture. We believe that the processes we have established for assessing, identifying, and managing material risks from cybersecurity allow us to effectively mitigate potential impacts and protect our business, operations, and products:


text: In-sourced IT Services: By in-sourcing IT services in late 2023, we gained greater control over IT decisions, established a comprehensive knowledge base, and laid a framework allowing for unbiased assessments of future IT and cybersecurity investments.


text: 24/7 Network Monitoring: Our continuous 24/7 second-level maintenance and monitoring contract provides constant vigilance against network disruptions and potential cyber threats, ensuring swift detection and mitigation of incidents.


text: Cutting-edge Data Backup: Deployment of our new data backup system is underway, offering robust protection against catastrophic failures, early detection of data loss prevention events, and near real-time mitigation of ransomware attacks. Full implementation is anticipated by the end of the first quarter of 2024.


text: In addition, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: We face risks from cybersecurity threats that could have a material adverse effect on our relationship with our partners, suppliers and eventual customers, or on our business, operations or products. We have experienced, and will likely continue to experience, cybersecurity incidents in the normal course of our business, however, we are not aware that we have experienced a material cybersecurity incident during fiscal 2023. See "Risk Factors – Risks Related to Privacy and Security – If we experience a significant cybersecurity breach or disruption in our information systems or any of our partners' information systems, our business could be adversely affected."

stage1Category: Strategy Integration


text: Proactive Defense: We utilize industry-standard mechanisms to assess, identify, and address potential threats from cybersecurity incidents. Our dedicated information technology (IT) team continuously monitors the evolving cybersecurity landscape and develops robust response processes to swiftly and effectively handle emerging threats.


text: Structured Framework: Our company-wide cybersecurity policy outlines our security posture and incident response protocol, ensuring clear escalation procedures to inform senior management, the Audit Committee, and the Board of Directors of cybersecurity events as needed.


text: Independent Oversight: The Audit Committee, composed entirely of independent directors under SEC and NYSE rules, oversees our cyber risk exposure and evaluates our risk mitigation strategies. The committee was briefed by our VP, IT Services in depth, and in turn briefs the Board of Directors on any material cyber risks and events.


text: Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including third party penetration tests, external security audits of our data loss prevention mechanisms and require that our vendors comply with Service Organization Control Type II requirements.


text: Previously, our information security program was led by our Vice President of Compliance and Information Technology, who has since left the Company. As of February 25, 2025, the responsibilities of this role are being performed on an interim basis by our IT Manager, whose experience includes two years supporting the cybersecurity function under the Vice President of Compliance and Information Technology. We are currently seeking a replacement to oversee our information security program.


text: In-sourced IT Services: By in-sourcing IT services in late 2023, we gained greater control over IT decisions, established a comprehensive knowledge base, and laid a framework allowing for unbiased assessments of future IT and cybersecurity investments. We have continued improvements using in-sourced IT services throughout 2024.


text: We face risks from cybersecurity threats that could have a material adverse effect on our relationship with our partners, suppliers and eventual customers, or on our business, operations or products. We have experienced, and will likely continue to experience, cybersecurity incidents in the normal course of our business; however, to our knowledge, we have not experienced a material cybersecurity incident during fiscal 2024. See "Part I, Item 1A. Risk Factors – Risks Related to Privacy and Security – If we experience a significant cybersecurity breach or disruption in our information systems or any of our partners' information systems, our business could be adversely affected."


text: Our cybersecurity policies, standards, processes, and practices are fully integrated into the Company's risk management and incident response program and are based on recognized frameworks established by the National Institute of Standards and Technology (NIST), the American Institute of Certified Public Accountants (AICPA), the International Organization for Standardization (ISO) and other applicable industry standards. We take a multi-layered approach to cybersecurity, continually updating, innovating, and refining our security practices, policies and procedures to mitigate risk, meet new industry standards and address the evolving threat landscape. The overall cybersecurity program is modeled on the NIST Cybersecurity Framework and customized to meet our specific needs.

companyName: Matterport, Inc./DE


text: Governance: Our Board of Directors, in coordination with the Audit Committee, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, and ongoing updates regarding any such incident until it has been addressed.


text: Security Leadership and Function Team: Our Chief Information Officer oversees our Security organization, which is a team of people dedicated to keeping company and personal information and systems safe from unauthorized alteration, disclosure, destruction and intrusion. Our CIO has more than 20 years of extensive information technology and cyber security management experience. Our Security Steering Committee is made up of our Chief Information Officer (CIO), Chief Technology Officer (CTO), members of our Information Security Team, and key individuals depending on the risk being addressed. The Security Steering Committee meets quarterly to review security risks and discuss upcoming priorities. The CIO, in coordination with the Security Steering Committee, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats, lower risk of a cybersecurity incident, and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. We continue to invest in enterprise-grade certification of our practices. In the event of an incident, we intend to follow our detailed incident response protocol, which outlines the steps to be followed from incident detection, investigation, mitigation, recovery and communication including notifying functional areas, senior leadership and the Board, as appropriate.


text: Collaborative Approach: Our cybersecurity program leverages a defense-in-depth strategy to proactively identify and remediate threats. The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Physical, Administrative, and Technical Safeguards: The Company deploys appropriate safeguards that are designed to protect the Company's information systems from cybersecurity threats, including endpoint security, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments, penetration tests, and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We established and maintain comprehensive incident response and recovery policies and procedures that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. We build resilience into our business model and roadmap, and work to avoid cybersecurity incidents. If an issue does occur, we rapidly identify and resolve it through our formalized incident response program designed to help us quickly detect, respond to and recover from any incident.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

stage1Category: Third-Party Risk


text: The Audit Committee, pursuant to its charter, has oversight over management of cybersecurity risks. Senior management and our IT Director provide the Audit Committee with periodic updates on data management and cybersecurity initiatives, as well as on significant existing and emerging cybersecurity risks, including cybersecurity incidents, as applicable.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: Education and Awareness: All employees must complete mandatory, annual comprehensive security awareness training. Our Security organization updates the training to address emerging threats and trends. We also conduct periodic phishing and other social engineering simulations to test our defenses and offer focused phishing training for those who may require additional education.


text: In addition, we also perform the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including internal validation and external audits, risk assessments, penetration tests, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including SOC2 reporting, SOX IT audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Security Steering Committee and the Audit Committee. The Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and threat intelligence. The Company is unaware of any cybersecurity threats that have materially affected or are reasonably likely to impact it.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See the risk factor, entitled "We rely significantly on the use of information technology. Cybersecurity risks – any technology failures causing a material disruption to operational technology or cyber-attacks on our systems affecting our ability to protect the integrity and security of customer and employee information – could harm our reputation and/or could disrupt our operations and negatively impact our business" in Item 1A - Risk Factors.


text: Security Leadership and Function Team: Our Chief Technology Officer ("CTO") oversees our Security organization, which is a team of people dedicated to keeping company and personal information and systems safe from unauthorized alteration, disclosure, destruction and intrusion. Our Security Steering Committee is made up of our CTO, members of our Information Security Team, and key individuals depending on the risk being addressed. The Security Steering Committee meets quarterly to review security risks and discuss upcoming priorities. The CTO, in coordination with the Security Steering Committee, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats, lower risk of a cybersecurity incident, and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. We continue to invest in enterprise-grade certification of our practices. In the event of an incident, we intend to follow our detailed incident response protocol, which outlines the steps to be followed from incident detection, investigation, mitigation, recovery and communication including notifying functional areas, senior leadership and the Board, as appropriate.


text: Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, and employees, has delegated oversight of our cybersecurity risk management to the Audit Committee. Our cybersecurity policies, standards, processes, and practices have been established as part of our risk management program and are based on recognized frameworks, including as adopted by the National Institute of Standards and Technology (the "NIST"). In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Nerdy Inc.

ticker: NRDY


text: Our cybersecurity program focuses on these key areas: • Governance: The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Chief Technology Officer ("CTO") and other members of management. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices. • Cross-Functional Approach: We have adopted a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Third-Party Risk Management: We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments. • Incident Response and Recovery Planning: We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: We engage in the periodic assessment and testing of our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include internal and external activities, including reviews of our information security control environment, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning, and information security maturity assessments.


text: The CTO and Vice President, Engineering and Security in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO"), among others, work collaboratively across functions to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communication, we monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: In late 2023, the Board of Directors delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee receives regular presentations and reports on cybersecurity risks, and prior to the Board's delegation, the Board periodically received such presentations and reports. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the CTO and the Vice President, Engineering and Security.


text: Our CTO has served in various roles in information technology and information security for over a decade, and holds a doctorate in mathematics from the London School of Economics and Political Science. The Vice President, Engineering and Security has served in various roles in information technology for over 25 years. Our CEO, CFO and CLO each hold degrees in their respective fields, and each have experience managing risks, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Depending on their nature, cybersecurity threats in the future may materially affect our business strategy, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this report.


text: Our cybersecurity program focuses on these key areas: • Governance: The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Chief Technology Officer ("CTO") and other members of management. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices. • Cross-Functional Approach: We employ a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Third-Party Risk Management: We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments. • Incident Response and Recovery Planning: We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: The Audit Committee receives regular presentations and reports on cybersecurity risks. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the CTO and the Vice President, Engineering and Security.


text: Risk Management and Strategy The Company's cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security of our information, systems, products and network. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. We use these frameworks, together with information collected from assessments, to tailor aspects of our cybersecurity and data privacy practices given the nature of our assets, operations and business. Key features of our cybersecurity and data privacy processes and procedures include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements controls that are tailored based on risk and designed to protect the confidentiality, integrity and access to our information systems and information stored on our networks, including member, customer and employee information, intellectual property and proprietary information. We employ in-depth defense mechanisms throughout our enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and managed security services to monitor, mitigate and/or prevent cybersecurity incidents. • Cybersecurity incident management and response: We have a cybersecurity incident response plan and specified teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, our cross-functional teams lead the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic simulations of common incidents. Further, we work closely with our external managed security services experts to provide ongoing monitoring and to augment our internal cybersecurity team with incident management and response specialists. • Cybersecurity awareness and training: Our employees are required to complete security awareness training and a compliance course annually, which we believe helps our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees in accordance with member or customer requirements and regulatory obligations. Further, we regularly communicate with employees about evolving cybersecurity trends through company-wide cybersecurity alerts, which heightens awareness of cybersecurity events that may be impacting our business, peers and industry. • Our assessments of third parties: We have implemented a third-party risk management process that includes, among other things, periodic cybersecurity assessments on certain third parties on which we rely based on an assessment of their risk profile. We also seek contractual commitments from third parties to satisfy our cybersecurity and data privacy requirements, and require third parties to maintain their information technology systems and protect Wheels Up information that is processed on their systems.

companyName: Wheels Up Experience Inc.

ticker: UP


text: • Third-party assessments of Wheels Up: We have engaged third-party cybersecurity companies to periodically assess our cybersecurity and data privacy processes and procedures, and to assist in identifying and remediating risks from cybersecurity threats. Our third-party assessors regularly conduct penetration testing and measure our processes, procedures and responses against industry standard frameworks. We use the results of these periodic assessments to implement programmatic changes and continuous improvements in alignment with business requirements, industry standards and regulatory requirements.


text: We believe our cybersecurity risk management practices are an important part of our enterprise risk management processes, and must be continuously updated and improved. As of the date of this Annual Report, we have not identified material risks from known cybersecurity threats, including as a result of any past cybersecurity incidents, since the beginning of the last full fiscal year that have materially affected the Company, including our business strategy, results of operations or financial condition. See Part I, Item 1A "Risk Factors—Risks Relating to Technology, Cybersecurity and Data Privacy" for more information about cybersecurity and data privacy risks.


text: The Board, the Audit Committee and management each actively assess the Company's cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. The Board and the Audit Committee regularly review the Company's cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. The Audit Committee receives periodic reports from our Chief Information Security Officer ("CISO") and other members of management to the extent their relevant areas are impacted, regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations. The Audit Committee then briefs the Board at scheduled meetings about cybersecurity and data privacy developments.


text: Management is responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO, who reports to our Chief Digital Officer, has primary oversight of material risks from cybersecurity and data privacy matters. Our CISO has more than 25 years of experience across various information technology, information security and management roles, including leading the development and implementation of cybersecurity and data privacy strategies for the member and customer-facing aspects of our business. In addition, our CISO holds degrees in Engineering Technology and Information Systems and Technology, and industry certifications awarded by the International Information System Security Certification Consortium (ISC2); Certified Information Systems Security Professional (CISSP), and Information Systems Security Engineering Professional (ISSEP).


text: Our CISO supervises a team of cyber risk architects, engineers and managers who actively work to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. Our cyber risk team collaborates with internal stakeholders to identify and analyze cybersecurity risks to the Company, implement appropriate controls and enable leaders to make risk-based business decisions that implicate cybersecurity considerations. Our CISO also reports on our cybersecurity and data privacy processes, procedures and risks to our executive management team when changes or risks are expected to impact other portions of the business, including with respect to the Wheels Up mobile app, website and proprietary pricing algorithms.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Head of IT who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. We have a dedicated IT resource with expertise in cybersecurity and risk management who is dedicated to working with our internal IT team on cybersecurity risk management.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: Risk Management and Strategy The Company's cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security of our information, systems, products and network. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. We use these frameworks, together with information collected from assessments, to tailor aspects of our cybersecurity and data privacy practices given the nature of our assets, operations and business. Key features of our cybersecurity and data privacy processes and procedures include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements controls that are tailored based on risk and designed to protect the confidentiality, integrity and access to our information systems and information stored on our networks, including member, customer and employee information, intellectual property and proprietary information. We employ in-depth defense mechanisms throughout our enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and managed security services to monitor, mitigate and/or prevent cybersecurity incidents. • Cybersecurity incident management and response: We have a cybersecurity incident response plan and specified teams to respond to cybersecurity incidents. If a cybersecurity incident occurs or we identify a vulnerability, our cross-functional teams lead the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic simulations of common incidents. Further, we work closely with our external managed security services experts to provide ongoing monitoring and to augment our internal cybersecurity team with incident management and response specialists. • Cybersecurity awareness and training: Our employees are required to complete security awareness training and a compliance course annually, which we believe helps our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees in accordance with member or customer requirements and regulatory obligations. Further, we regularly communicate with employees about evolving cybersecurity trends through company-wide cybersecurity alerts, which heightens awareness of cybersecurity events that may be impacting our business, peers and industry. • Our assessments of third parties: We have implemented a third-party risk management process that includes, among other things, periodic cybersecurity assessments on certain third parties on which we rely based on an assessment of their risk profile. We also seek contractual commitments from third parties to satisfy our cybersecurity and data privacy requirements, and require third parties to maintain their information technology systems and protect Wheels Up information that is processed on their systems.


text: We believe our cybersecurity risk management practices are an important part of our enterprise risk management processes, which must be continuously updated and improved. As of the date of this Annual Report, we have not identified risks from cybersecurity threats, including as a result of any past cybersecurity incidents, since the beginning of the last full fiscal year that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. See the caption titled "Risks Relating to Technology, Cybersecurity and Data Privacy" in Part I, Item 1A "Risk Factors" in this Annual Report for more information about cybersecurity and data privacy risks.


text: The Board, the Audit Committee and management each actively assess the Company's cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. The Board and the Audit Committee regularly review the Company's cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. The Audit Committee receives periodic reports from our Chief Information Security Officer ("CISO") and other members of management, to the extent their relevant areas are impacted, regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations. The Audit Committee then briefs the Board at scheduled meetings about cybersecurity and data privacy developments.


text: Management is responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO, who reports to our Chief Digital Officer, has primary oversight of material risks from cybersecurity threats. Our CISO has more than 25 years of experience across various information technology, information security and management roles, including leading the development and implementation of cybersecurity and data privacy strategies for the member and customer-facing aspects of our business. In addition, our CISO holds degrees in Engineering Technology and Information Systems and Technology, and industry certifications awarded by the International Information System Security Certification Consortium (ISC2); Certified Information Systems Security Professional (CISSP), and Information Systems Security Engineering Professional (ISSEP). We also have a U.S. Data Privacy Officer, who reports to our Chief Legal Officer, and a European Data Privacy Officer, who reports to our CISO, each of whom have primary oversight of material risks related to data privacy in their respective territories. Our U.S. Data Privacy Officer, who is a licensed attorney, holds industry certifications awarded by the International Association of Privacy Professionals (IAPP). Our European Data Privacy Officer has a master's degree in public international law and over 10 years of experience working in cybersecurity, data protection and governance.


text: Our CISO supervises a team of cyber risk architects, engineers and managers who actively work to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means. Our cyber risk team collaborates with internal stakeholders to identify and analyze cybersecurity risks to the Company, implement appropriate controls and enable leaders to make risk-based business decisions that implicate cybersecurity considerations. Our CISO also reports on our cybersecurity and data privacy processes, procedures and risks to our executive management team when changes or risks are expected to impact other portions of the business, including with respect to the Wheels Up mobile app, website and proprietary pricing algorithms.


text: The Audit Committee of our Board of Directors is primarily responsible for oversight of the Company's risk assessment and risk management, including cybersecurity risks. The committee meets at least annually with our Head of Information Technology, who provides a report on the Company's current risk assessment as well as mitigation efforts. The Audit Committee also periodically updates the Board of Directors on risk matters.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: Risk Management and Strategy We recognize that our customers have a legitimate expectation of safety and privacy when they do business with us. We deploy considerable resources to protect customer data and privacy because our business depends on our customers' trust. We recognize that there is a cost and risk associated with every piece of data our customers entrust us with, so we take measures to minimize what is collected to only what we need to provide a great experience and meet our legal and regulatory requirements. In addition, we have integrated cybersecurity risk management into our broader risk management framework through our (i) regular enterprise risk management updates to the Audit Committee, (ii) information technology and security related internal controls and (iii) incident response and vulnerability management programs.

companyName: Bark, Inc.

ticker: BARK


text: We actively assess, identify, and manage material risks associated with cybersecurity threats. Our information security, finance, procurement, legal and other cross-functional teams work together to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. All employees are required to complete annual information security training and periodic training specifically related to phishing. We have an enterprise-wide Information Security Incident Response Plan ("Incident Response Plan") which describes the detailed processes and procedures that should be followed in the event of an information security incident. We periodically perform tabletop exercises with management participation to be able to effectively respond to an information security incident and evaluate and improve the Incident Response Plan. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, internal reporting, monitoring and detection and vulnerability tools.


text: We also engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our information security processes. These partnerships enable us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: In order to mitigate data or security incidents that may originate from third-party vendors or suppliers, we conduct both privacy and information security assessments to properly identify, prioritize, assess and remediate any third-party risks, and require information security and privacy addenda to our contracts where applicable.


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.


text: Our Board of Directors (the "Board") is ultimately responsible for the risk oversight of the company, including, cybersecurity and privacy risks. Our Board has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee is composed of board members with diverse expertise enabling its members to oversee cybersecurity risks effectively. Our Audit Committee's responsibilities include reviewing the Company's cybersecurity and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to data breaches.


text: At the management level, a management steering committee comprised of our Chief Financial Officer, Controller, and General Counsel is briefed quarterly by our Director of Information Security. Our Director of Information Security also prepares a quarterly Information Security Risk Report, which is provided to the management steering committee in advance of its quarterly meeting and also made available to the members of the Audit Committee. Our current Director of Information Security has 16 years of industry experience leading large-scale security initiatives, enhancing infrastructure defenses and instilling a culture of security awareness across all employee levels. Additionally, our Director of Information Security holds standard industry security certifications, including CISSP (Certified Information Systems Security Professional).


text: The Audit Committee will receive reports, briefings and presentations from senior management, including our Director of Information Security, at periodic committee meetings, including, on a rotating basis, in-depth presentations on specific areas of risk and regular enterprise risk management updates as needed. In addition to scheduled meetings, significant developments or incidents, even if immaterial to us, are reviewed regularly by a cross-functional team, including the Chief Financial Officer and the General Counsel, to determine whether further escalation to the Audit Committee and/or the Board is appropriate, ensuring the Audit Committee's and the Board's oversight is timely and responsive. Our Incident Response Plan also includes immediate actions to mitigate the impact and strategies for remediation and prevention of future incidents.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Center for Internet Security (CIS) Critical Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and CIS Controls as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: GCM Grosvenor Inc.

ticker: GCMG


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, nor do we believe they are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.


text: At the management level, a management steering committee comprised of our Chief Financial Officer, Controller, and General Counsel is briefed quarterly by our Director of Information Security. Our Director of Information Security also prepares a quarterly Information Security Risk Report, which is provided to the management steering committee in advance of its quarterly meeting and also made available to the members of the Audit Committee. Our current Director of Information Security has 17 years of industry experience leading large-scale security initiatives, enhancing infrastructure defenses and instilling a culture of security awareness across all employee levels. Additionally, our Director of Information Security holds standard industry security certifications, including CISSP (Certified Information Systems Security Professional).


text: Our ITGCs are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our Board of Directors. We conduct cybersecurity penetration testing annually to identify and remediate cybersecurity gaps. We also perform cybersecurity assessments of all our third-party providers who have access to our information technology systems and data.


text: Integrated Risk Management Management is responsible for the day-to-day management of our risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of our risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, prioritize, manage, monitor and report current and emerging information security related risks, including risks associated with our use of third-party service providers. As part of this framework, we have an Enterprise Risk Management ("ERM") program which is implemented across the Company to promote a strong Company-wide culture of risk management, compliance, and control.

companyName: Clever Leaves Holdings Inc.

ticker: CLVR


text: Our processes for assessing, identifying and managing information security risks and vulnerabilities are embedded across our business as part of our ERM program. As part of ERM program, we perform risk assessments in which we map and prioritizes information security risks identified and addressed through a multi-faceted approach of processes described here, including third party assessments. We execute periodic audits and tests of our information system security controls in-house such as a vulnerability analysis of the information and the infrastructure of our sites. We engage third-party services to assist in designing the ITGC controls and evaluating them periodically either through independent audits or consulting on best practices to address new challenges. These evaluations include both the design and operational effectiveness of the controls. Our risk management program also assesses third party risks, and we perform third party risk management to identify and mitigate risks from third parties such as vendors and suppliers associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers. Among other things, we conduct periodic infrastructure monitoring including assessment of existing technology hardware and software configurations, patches and updates and also implement automated tools. We provide recurrent information security awareness training for employees and carry out periodic campaigns related to safety awareness which include interactive activities involving the employee participation. Additionally, we have also implemented incident management protocols to analyze, remediate, and respond to activities that implicate potential risk to data and information. Through this methodology we remediate information security incidents and comply with potential legal obligations mitigating brand and reputational damage.


text: Impact of Risks from Cybersecurity Threats We have identified a material weakness in our information technology general controls. These controls over user access to certain information technology systems that support our financial reporting process were not properly designed and implemented. We have since made efforts to remediate the identified material weakness. There have otherwise been no risks from cybersecurity threats at the Company to date that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Governance.


text: The board of directors of the Company (the "Board") has oversight responsibility for our risk management framework, including technology and cybersecurity risks facing the Company. The ERM program enables the board to establish a mutual understanding with the management of the effectiveness of its information security risk management practices and capabilities including the division of responsibilities for reviewing its information security risk exposure and risk tolerance, tracking emerging information risks, and reviewing for proper escalation of certain key risks for periodic review by the Board.


text: The Board receives briefings from management and security and technological infrastructure team on enterprise-wide technology, cybersecurity risk management and the overall technology and cybersecurity environment by management. Specifically, the Board receives an Annual Security Information Report which details the plan for cybersecurity management, reviews the result of the implementation of threat control activities and conclusions for the period evaluated.


text: Role of Management In addition to the risk management activities undertaken under the ERM Program, where management assesses and manages material risks from cybersecurity threats, our security and technological infrastructure team led by Technology Infrastructure and Security Manager, is responsible for day-to-day identification, assessment and management of the information security risks we face. Personnel in our security and infrastructure team collectively have decades of experience in information security, information technology and cybersecurity operations. These personnel are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents detected through automated detection and monitoring tools. The team manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes procedures such as: (i) reporting of the incident through a ticket management tool designated by the Company, (ii) identification and analysis, (iii) monitoring, containment, and eradication, (iv) remediation and creation of controls, and (v) lessons learned and preparation for future incidents. The Technology Infrastructure and Security Manager provides regular updates to the Board concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.


text: We continue to make substantial investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed quarterly by our Board of Directors.


text: Risk Management and Strategy As of December 31, 2023, we've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: We also engage other consultants, and other third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our Board of Directors and Audit Committee are responsible for overseeing our cyber security risk management and strategy.


text: Our Head of IT provides periodic briefings to the Audit Committee including our cybersecurity risks and activities, any potential cybersecurity incidents and related responses, cybersecurity systems testing and, activities of third parties. Our Audit Committee regularly meets with our Chief Financial Officer and Head of IT about the Company's ongoing compliance and risk management and reports to the Board regularly.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".


text: Risk Management and Strategy As of December 31, 2024, we've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our information technology general controls are established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our Board of Directors. We conduct cybersecurity penetration testing annually to identify and remediate cybersecurity gaps. We also perform cybersecurity assessments of all our third-party providers who have access to our information technology systems and data.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Head of Information Technology ("IT") who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. We have a dedicated IT resource with expertise in cybersecurity and risk management who is dedicated to working with our internal IT team on cybersecurity risk management.


text: We also engage other consultants and other third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.


text: Our Head of IT provides periodic briefings to the Audit Committee including our cybersecurity risks and activities, any potential cybersecurity incidents and related responses, cybersecurity systems testing and, activities of third parties. Our Audit Committee regularly meets with our Chief Financial Officer and Head of IT about the Company's ongoing compliance and risk management and reports to the Board of Directors regularly.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls and (3) response to cybersecurity incidents; • policies, security technologies and safeguards to fulfill overall NIST CSF program goals and key controls established by the CIS; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security program; this includes penetration testing, and assisting internal audit in assessing the effectiveness of our controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Please see the section entitled "Risk Factors –Failure to maintain the security of our information and technology networks, or those of our third-party service providers, or cyber security incidents could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow," for more information.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity and other information technology risks. The audit committee oversees management's implementation of our cybersecurity risk management program.


text: The audit committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the audit committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The audit committee reports to the full board of directors regarding its risk management activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cyber risk management program from time to time. Members of the board of directors receive presentations on cybersecurity topics from our Chief Technology Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including the Chief Technology Officer and Chief Information Security Officer, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our current Chief Technology Officer has over 25 years of cybersecurity experience, including past roles as a Chief Information Security officer and with a leading accounting and professional services firm. Our current Chief Information Security Officer has 20 years of relevant information technology and cybersecurity experience.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Center for Internet Security (CIS) Critical Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and CIS Controls as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: During the last three fiscal years, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see Item 1A "Risk Factors" in this Annual Report on Form 10-K.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Please see the section entitled "Risk Factors –Failure to maintain the security of our information technology networks, or those of service providers and other our third-parties, or cybersecurity incidents could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow," for more information.


text: Our management team, including the Chief Technology Officer and Chief Information Security Officer, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our current Chief Technology Officer has over 25 years of cybersecurity experience, including past roles as a Chief Information Security Officer and with a leading accounting and professional services firm. Our current Chief Information Security Officer has 20 years of relevant information technology and cybersecurity experience.


text: Risk Management & Strategy We have established a risk-based process for assessing, identifying and managing material cybersecurity threats. Our security program utilizes various tools, including physical, administrative and technical safeguards designed to help prevent and respond to cybersecurity threats and incidents. As risks are identified, we implement a variety of measures to manage and mitigate these risks such as firewalls, intrusion detection processes/systems, and vulnerability management. We have a Cyber Defense Center that utilizes incident response plans and various tools such as Splunk and Crowdstrike to respond and recover from cyber incidents. We also have an outside firm on retainer should the need arise to obtain additional assistance.


text: In addition, we have established an Information Security Awareness Program focused of several areas: • Formal training on topics such as phishing each month; • During Cyber Security Awareness month we provide additional training on topics like IT Policy, access management, and effective password management; • Company-wide informal training through lunch & learn sessions and department meetings; • Tabletop exercises with key personnel during which we simulate cybersecurity threats to test our capabilities and continually improve our response protocols.


text: We are actively engaged with the Aviation Information Sharing and Analysis Center (ISAC) which gathers, analyzes and shares information to combat cyber-related threats and weaknesses. We use this information to ensure we are aware of possible threats that could occur within our industry.


text: Keith Moss, our Head of Information Technology, oversees our cybersecurity and information security program. He has over 30 years of experience in various CISO and information technology roles, and was previously the IT Director at Ford Motor Company North America. He holds a Master of Science in Computer Engineering and a Bachelor of Science in Computer Science from the University of Michigan and an MBA from Bowling Green State University.


text: During the last three fiscal years, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see Item 1A "Risk Factors" in this Annual Report.


text: The Audit Committee of our Board of Directors is primarily responsible for oversight of the Company's risk assessment and risk management, including cybersecurity risks. The committee meets at least annually with our Head of Information Technology, who provides a report on the Company's current risk assessment as well as mitigation efforts. The Audit Committee also periodically updates the Board of Directors on risk matters.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. In general, the Company seeks to address cybersecurity risks through a comprehensive and cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our enterprise security program has been developed based on industry standards, including those published by the International Organization for Standardization (ISO) and the National Institute of Standards and Technology ("NIST").

companyName: SkyWater Technology, Inc

ticker: SKYT


text: Governance - The Board has designated that the Audit Committee is responsible for overseeing cybersecurity risks, and our Senior Vice President of Information Technology and Supply Chain Management ("SVP of IT & SCM") reports to the Audit Committee on cybersecurity matters. The SVP of IT & SCM has over 20 years of experience in IT systems, IT infrastructure, fab and manufacturing environments, and site disaster recovery and compliance. Our IT administration team supports the SVP of IT & SCM and has deep working knowledge of the NIST cybersecurity framework, the Cybersecurity Maturity Model Certification (CMMC) program, ISO 27001, and extensive experience in systems and technology infrastructure management. In addition, our Director of Corporate Security reports to our Chief Legal Officer and is involved in the ongoing compliance with relevant cybersecurity regulations, including with regard to cybersecurity monitoring and incident response (as noted below). The Director of Corporate Security has over 20 years of experience in quality systems, semiconductor manufacturing, and industrial security.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Cipher Digital Inc.

ticker: CIFR


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Risk Assessment - Our enterprise risk assessment is performed by executives, management, and functional and department-level subject matter experts. This group engages in the ongoing monitoring of identified risks to the Company and risk mitigation efforts. Our enterprise risk management process captures the potential impact and likelihood of cybersecurity risk events by evaluating our current cybersecurity risk environment and our existing cybersecurity controls. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The SVP of IT & SCM, senior leadership, and our internal audit function provide both the full Board and the Audit Committee with periodic updates on the performance of our cybersecurity program.


text: Monitoring and Incident Response - The Company's cybersecurity program protects against threats through use of the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls and remediation practices; implementing a third-party risk management program to evaluate our critical partners' cyber posture; and evaluating our program effectiveness by performing internal and external assessments. The Company engages a third-party service provider to perform annual internal and external penetration testing under NIST special paper (SP) 800-171 requirements to identify potential gaps that require remediation. In addition, the Company utilizes several industry-standard software applications to monitor for cybersecurity threats and alert our Director of Corporate Security and IT administration of any incidents that require escalation to the SVP of IT & SCM and the Audit Committee. Threats and incidents identified are immediately investigated by the IT administration team and appropriate action is taken to mitigate the impact to the Company.


text: Education and Awareness - We conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action. We install and regularly update antivirus software on all company managed systems and workstations to detect and prevent malicious code from impacting our systems. In addition, we have a product security team focused on integrating risk and security best practices into our product development life cycle. Periodically, we are audited by an independent information systems expert to determine both the adequacy of, and compliance with, controls and standards.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks, threats or incidents. The potential consequences of a future material cybersecurity incident may include reputational damage, litigation with third parties, government enforcement actions, penalties, disruption to our systems or operations of our facilities, unauthorized release of confidential or otherwise protected information, corruption of data, diminution in the value of our investment in research, development and engineering, increased cybersecurity protection costs and unplanned remediation costs, which in turn could adversely affect our business strategy, results of operations and financial condition. See Item 1A under the caption "A breach of our security systems or a cyberattack that disrupts our operations or results in the breach of confidential information about us, our technology, or our customers could harm our business and expose us to costly regulatory enforcement and other liability." for additional information on cybersecurity risks applicable to the Company.


text: Governance - The Board has designated that the Risk Management Committee is responsible for overseeing cybersecurity risks, and our Senior Vice President of Information Technology and Supply Chain Management ("SVP of IT & SCM") reports to the Risk Management Committee on cybersecurity matters. The SVP of IT & SCM has over 20 years of experience in IT systems, IT infrastructure, fab and manufacturing environments, and site disaster recovery and compliance. Our IT administration team supports the SVP of IT & SCM and has deep working knowledge of the NIST cybersecurity framework, the Cybersecurity Maturity Model Certification (CMMC) program, ISO 27001, and extensive experience in systems and technology infrastructure management. In addition, our Director of Corporate Security reports to our Chief Risk and Compliance Officer and is involved in the ongoing compliance with relevant cybersecurity regulations, including with regard to cybersecurity monitoring and incident response (as noted below). The Director of Corporate Security has over 20 years of experience in quality systems, semiconductor manufacturing, and industrial security.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Members of the Audit Committee have experience in overseeing and managing cybersecurity and data privacy risks.


text: Risk Assessment - Our enterprise risk assessment is performed by executives, management, and functional and department-level subject matter experts. This group engages in the ongoing monitoring of identified risks to the Company and risk mitigation efforts. Our enterprise risk management process captures the potential impact and likelihood of cybersecurity risk events by evaluating our current cybersecurity risk environment and our existing cybersecurity controls. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The SVP of IT & SCM, senior leadership, and our internal audit function provide both the full Board and the Risk Management Committee with periodic updates on the performance of our cybersecurity program.


text: Monitoring and Incident Response - The Company's cybersecurity program protects against threats through use of the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls and remediation practices; implementing a third-party risk management program to evaluate our critical partners' cyber posture; and evaluating our program effectiveness by performing internal and external assessments. The Company engages a third-party service provider to perform annual internal and external penetration testing under NIST special paper (SP) 800-171 requirements to identify potential gaps that require remediation. In addition, the Company utilizes several industry-standard software applications to monitor for cybersecurity threats and alert our Director of Corporate Security and IT administration of any incidents that require escalation to the SVP of IT & SCM and the Risk Management Committee. Threats and incidents identified are immediately investigated by the IT administration team and appropriate action is taken to mitigate the impact to the Company.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks, threats or incidents. The potential consequences of a future material cybersecurity incident may include reputational damage, litigation with third parties, government enforcement actions, penalties, disruption to our systems or operations of our facilities, unauthorized release of confidential or otherwise protected information, corruption of data, diminution in the value of our investment in research, development and engineering, increased cybersecurity protection costs and unplanned remediation costs, which in turn could adversely affect our business strategy, results of operations and financial condition. See Item 1A under the caption "A breach of our security systems or a cyberattack that disrupts our operations or results in the breach of confidential information about us, our technology, or our customers could harm our business and reputation, and could expose us to costly regulatory enforcement and other liability." for additional information on cybersecurity risks applicable to the Company.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment; • individuals, including employees and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business, Industry and Operations— If we or our third-party providers fail to protect confidential information and/or experience cybersecurity incidents, such as cyber-attacks, data breaches, hacking attacks or malware, there may be disruptions to our operations, triggering significant liability for us, which could harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business."


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our management team have prior work experience in supervising and implementing cybersecurity risk mitigation efforts in highly-regulated industries. Our internal cybersecurity personnel and retained external cybersecurity consultants also have a breadth of expertise across core cybersecurity disciplines including governance, risk, compliance, and security architecture.


text: Our management team takes steps to stay informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy We rely on information technology and data to operate our business and develop, market and deliver our services to our customers. Our information technology includes various cloud computing resources, computer networks, third party hosted services, communications systems, software, and our data (which includes confidential, personal, proprietary and sensitive data) (collectively "Information Assets"). We maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business.

companyName: Grindr Inc.

ticker: GRND