text: To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: Our company recognizes the importance of safeguarding company and customer information. Therefore, the Board of Directors recognizes that the protection of this information ranks as one of our highest priorities. The Board of Directors is responsible for reviewing and approving the ICSPP and ICSIRP at least annually and monitoring material risks facing our company. The Board recently added a member who possesses specialized expertise in cybersecurity matters. Director Sara A. Schmidt currently serves as chief information security officer for US Foods and executive sponsor of the West Michigan Cyber Security Consortium.

companyName: MERCANTILE BANK CORP

ticker: MBWM

secItem: Item 1C

stage1Category: Board Governance

stage1Method: majority


text: Risk Assessment and Strategy Fuel Tech regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our Information Technology Steering Committee on a quarterly basis, or more frequently if deemed appropriate.

companyName: FUEL TECH, INC.

ticker: FTEK


text: The Board has tasked the SMT with overseeing efforts to develop, implement and maintain an effective information and cybersecurity program. The SMT designates the CISO who also serves as the IRT leader. As part of its oversight responsibilities, the Board of Directors is responsible for discussing with the SMT our company's major risk exposures, such as cybersecurity, and the steps management has taken to monitor and control those exposures, including our risk assessment and risk management policies. The Board of Directors also monitors our compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, our Tech Oversight Committee reviews with the SMT significant areas of risk exposure involving cybersecurity.

stage1Method: unanimous


text: At the direction of the SMT, the CISO and IRT monitor internal and external cybersecurity threats and review and revise our company's cybersecurity defenses on an ongoing basis. The CISO, together with other members of the IRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; and risk management and incident response. The CISO prepares reports on IT general controls and cybersecurity metrics for the SMT and Tech Oversight Committee periodically. The Board of Directors meets with the CISO periodically to discuss cybersecurity.

stage1Category: Management Role


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to mitigate cybersecurity risks, on a case-by-case basis, to our critical computer networks, third party-hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials (IT Assets). The Company's information security program, which is integrated into our overall risk management processes, evaluates threats posed by internal and external factors and supports daily operational functions that prevent unauthorized access or compromise.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX

stage1Category: Risk Management Process


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our IT Assets, which include implementing policies and guidelines governing the individual use and protection of IT Assets by employees, employee training, and leveraging the capability of third -party service providers to support our internal cybersecurity processes. These processes are aligned with standard industry frameworks, such as the National Institute of Standards and Technology, Committee of Sponsoring Organizations, International Organization for Standardization 27001, and other industry standards. We have also implemented a well-established information security incident response plan, which is designed to escalate cybersecurity incidents, depending on the circumstances, to appropriate stakeholders as defined by internal standard operating procedures. We continue to monitor proposed cybersecurity disclosure rules from the SEC and alter our procedures accordingly.


text: To further improve the effectiveness of our information security processes, we engage third -party service organizations to monitor the Company's information technology (IT) environment, conduct evaluations of the effectiveness of our security controls and provide aggregate monthly reports to our corporate IT Security Team regarding the results of such third -party assessments, training and vulnerability testing, data security posture, material cybersecurity risks and areas of improvement.


text: Risks from cybersecurity threats have not materially affected or are currently viewed as not reasonably likely to materially affect us, our business strategy, results of operations or financial condition. However, the scope and impact of any future cybersecurity incidents cannot be predicted and there can be no assurance that our information security program will be effective in preventing material cybersecurity incidents in the future. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Our internal information technology systems, or those of our third-party CROs, CMOs, or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug candidates' development programs and our commercialization of any products for which we receive regulatory approval."

stage1Category: Strategy Integration


text: The Board and our Chief Executive Officer is responsible for oversight of the Company's overall risk management program, including as to cybersecurity related risks, while management is responsible for the day-to-day risk management processes. The Board receives regular reports from our Chief Executive Officer, Chief Financial Officer and other members of management, regarding material cybersecurity threats and risks, effectiveness of our information security processes and status of ongoing cybersecurity initiatives and strategies. Our information technology (IT) team, which is overseen by our Vice President of IT, is responsible for the identification, assessment and management of cybersecurity risks we face and ensuring effective implementation of the Company's overall cybersecurity efforts. Our Vice President of IT has over 25 years of experience in IT systems, including cybersecurity risk management and incident response, and holds multiple industry-recognized certifications. Our Vice President of IT receives regular reports from the corporate IT Security Team, together with information provided by our third-party service organizations that monitor the Company's IT environment, regarding the Company's material cybersecurity threats and risks and the processes the Company has implemented to address them, which are reported to the Chief Financial Officer.


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: the use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.


text: Risk Management and Strategy We perform a formal risk assessment each year. As part of the Company's risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: The Audit Committee of our Board of Directors (the "Audit Committee") provides oversight over our internal control program, including the adequacy and effectiveness of our information technology infrastructure and cybersecurity program. Each quarter, management provides updates to the Audit Committee regarding its internal control program, including any significant changes to its information technology infrastructure or cybersecurity program. Management also reports any material risks from cybersecurity threats to the Audit Committee. Management periodically provides the Audit Committee with updates on cybersecurity risks and/or trends.


text: Our management team, specifically the chief executive officer and the chief financial officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including its third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.


text: As of the date of this Annual Report on Form 10 -K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risks titled " We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third -party vendors. " No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against cybersecurity threats. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: Risk Management and Strategy In the normal course of business, we collect and store sensitive information, including proprietary and confidential business information, intellectual property, information regarding clinical and non-clinical trials, sensitive third -party information and employee information.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA

stage1Category: None/Other


text: We have processes designed to protect our information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks. Our cybersecurity strategy includes the use of managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform periodical penetration testing and other logical, physical and technical controls designed to deter, prevent, mitigate and respond to cybersecurity threats. Further, our information systems include continuous alert plans, and we provide periodical cybersecurity reminders to our employees to emphasizes the importance of adherence to our security policies.


text: We conduct organizational risk assessment, which help management in identifying data assets and recognizing and assessing potential threats, and investigating potential vulnerabilities. We are in the process of reviewing and implementing incremental information technology strategies to mitigate cybersecurity risks and their possible impacts. Risk assessments enable management to make risk management decisions and assign resources to mitigate risk. We also periodically engage third parties to assess the effectiveness of our cybersecurity practices.


text: As of the date of this Annual Report, we do not believe that any past cybersecurity incidents that have been detected have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: See "Risk Factors - Risks Related to Our Business and Operations" for additional information about the risks to our business associated with cybersecurity or a breach or compromise to our information security systems.


text: Our Director of Information Technology has responsibilities which include preventing and monitoring cybersecurity threats and utilizes the assistance of external vendors in this effort. Our Director of Information Technology regularly reports to senior management regarding the status of our cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of our cybersecurity profile.


text: Our full Board of Directors oversees the risk management process for the Company, which includes identifying, assessing and managing enterprise-level risks. The Board administers this oversight function directly through the Board of Directors as a whole, as well as through its standing committees that address risks inherent in their respective areas of oversight. The risk oversight responsibility of the Board of Directors and its committees is supported by the management reporting processes, which are designed to provide visibility to the Board of Directors and to the personnel who are responsible for risk assessment and information about the identification, assessment and management of critical risks, and management's risk mitigation strategies. Our cybersecurity risk program directly integrates and is intended to align with the Board of Directors' overall risk management process.


text: Our management team views cybersecurity risk management as an important strategic topic. Our cybersecurity strategy utilizes the cybersecurity framework developed by the National Institute of Standards and Technology ("NIST CSF"). The NIST CSF is a voluntary framework of practices to identify, protect, detect, respond to, and recover from cybersecurity risks. Using the NIST CSF does not mean that we meet any particular technical standards or certifications, but rather that we use the NIST CSF to help us identify, assess, and manage cybersecurity risks relevant to our business. Using the NIST CSF, we form our cybersecurity plans and prioritize our activities using a risk-based approach which begins with the identification and evaluation of cybersecurity risks and threats that could disrupt our operations, safety procedures and regulatory compliance. Cybersecurity risks and related mitigation efforts are prioritized based on their potential impact severity, likelihood and vulnerability. Risk mitigation strategies include the application of cybersecurity policies and procedures, implementation of technology-based tools and controls, as well as employee training, education, and awareness initiatives. Our cybersecurity risk management includes ongoing monitoring of networks and systems for potential signs of suspicious activity. We track key performance indicators and cybersecurity metrics to evaluate the effectiveness of our cybersecurity safeguards and practices. We have established an incident response plan designed to promptly contain and remediate cybersecurity incidents.

companyName: Air Transport Services Group, Inc.


text: We rely increasingly on software applications, data transmissions and cybersecurity safeguards provided by or in conjunction with third parties to maintain our cybersecurity posture and evolve with the threat environment. We engage third party resources to assess our procedures, test safeguards, provide training and monitoring, and assess our vulnerabilities. We evaluate third party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture and data security standards.


text: ATSG management has overall responsibility for assessing and managing risks from cybersecurity threats to our operations. Management has a supervisory team that consists of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Vice President and Controller, and the Vice President of Information Technology, which meets regularly. The Vice President of Information Technology has primary responsibility for the execution of our cybersecurity risk management program and keeps the broader team informed about the detection, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of Information Technology and the Company's other information technology and security department personnel include individuals with advanced university degrees in cybersecurity and years of technology management experience in matters such as conducting threat assessments, cyber mitigation and incident response.


text: While the Board has the primary responsibility for risk oversight, the Audit Committee assists the Board in fulfilling its oversight responsibility with respect to the management of cybersecurity-related risks. Through its Cybersecurity Subcommittee, the Audit Committee periodically reviews and discusses with management, including the Vice President of Information Technology, (i) the Company's information security strategy, priorities and objectives; (ii) the Company's technology and information security risks, including with respect to cybersecurity and data privacy; and (iii) the steps management has taken to manage cybersecurity risk.


text: In 2024, we did not identify any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or that are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches may materially affect our business strategy, results of operations or financial condition. For additional discussion of potential risks regarding cybersecurity, please see the information contained in Risks Related to Business Interruptions and Cybersecurity Incidents in Part 1A of this Form 10-K.


text: The operation of our business is dependent on the secure functioning of our computer infrastructure. This infrastructure is used to maintain key processes including management of sensitive company information and operation of sales, record-keeping, and accounting functions.

companyName: RADNOSTIX INC

ticker: INIS


text: the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities.


text: the use of third -party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security risks.


text: the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.


text: We employ a specialized third-party information technology ("IT") management firm to monitor and manage our cybersecurity functions. Processes employed include real-time monitoring of company communications and IT activities and also consultation and risk assessment of company procedures. Additionally, our third-party IT firm provides education to management and employees regarding our IT risks. All our employees receive information security training (including data protection and fraud awareness) on an annual basis. Department managers are given additional risk management training as part of periodic management meetings. Our activities are monitored at all times by our IT firm. The IT firm reports all matters of cybersecurity including any threats, breaches, or risks directly to our Chief Financial Officer who reports directly to the Chief Executive Officer. Our Chief Financial Officer regularly meets with the IT firm to review our cybersecurity response plans, discuss any needed updates, and identify risk management actions to be taken. Updates regarding cybersecurity are provided to our directors at least annually and as needed for any important developments including cybersecurity breaches and risks. As of the date of this Annual Report, we know of no cybersecurity incident that has or is likely to materially affect us, our business strategy, our results of operations, or our financial condition.


text: We carry a cybersecurity insurance policy to help cover any costs that may occur from a cybersecurity incident. Although risks from cybersecurity threats and implementation of our cybersecurity program have not materially affected our business strategy, business operations or our financial condition, a cybersecurity incident could have a material adverse effect in the future if it were to cause business disruption or data loss.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of our Advisor and other third-party service providers. Our Advisor manages our day-to-day operations and has implemented a cybersecurity program that applies to us and its operations.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: Cybersecurity Program Overview Our Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Our Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: Our Advisor has identified a Cyber Incident Response Team, or Response Team, who is responsible for providing appropriate oversight, strategic direction, and decision making for an event that potentially could cause a material impact to our business. Our Response Team includes our Chief Financial Officer, Chief Compliance Officer and General Counsel, and Vice President of Operations and these individuals are responsible for coordinating the incident response, including any required notification to our Audit Committee or our Board.


text: We rely on our Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We rely on our Advisor's risk management program and processes, which include cyber risk assessments.


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of our Advisor when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Audit Committee Oversight of Cybersecurity Risks Our Audit Committee provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Audit Committee receives periodic updates from our Response Team regarding the overall state of our Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including our Response Team, is responsible for assessing and managing material risks from cybersecurity threats. Our management continuously assesses, meets and prioritizes cybersecurity risks and actions taken to mitigate these risks. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks. We leverage the resources of Monroe, including the Head of Information Technology, who provides resources and expertise to assist us in our cybersecurity program. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of our Advisor.


text: Assessment of Cybersecurity Risk In the past three years, we have not experienced a material cybersecurity breach. Our Advisor, including our Response Team, and our management assess on an on-going basis the potential impact of risks from cybersecurity threats on us, and regularly evaluate how such risks could materially affect our business strategy, operational results, and financial condition. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.


text: if necessary, the use of third -party security experts if and when an incident is detected We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.


text: Management Oversight Day-to day management of cybersecurity threats is conducted by our Information Technology department which is charged with identifying and reporting threats to senior management. On a quarterly basis, cybersecurity is reviewed by our Information Technology Steering Committee, which is comprised of our Chief Executive Officer, Chief Financial Officer, General Counsel and Head of Information Technology.


text: The Audit Committee of our Board of Directors, which is composed of all non-employee directors, is responsible for oversight of management's efforts to eliminate cybersecurity risks.


text: Cybersecurity Risk Management and Strategy The Trust does not have any officers, directors or employees. The Sponsor, an indirect subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: iShares Bitcoin Trust ETF

ticker: IBIT


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.


text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third -party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

stage1Category: Third-Party Risk


text: Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to BlackRock's Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2024, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.


text: BlackRock ' s Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: Cybersecurity Risk Management and Strategy The Trust does not have any officers, directors or employees. The Sponsor, an indirect subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: iShares Ethereum Trust ETF

ticker: ETHA


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.


text: The Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third -party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to BlackRock's Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2024, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.


text: BlackRock ' s Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: Risk Management and Strategy We rely on information systems to obtain, rapidly process, analyze, and manage data in order to effectively operate our business. We are committed to protecting our business information, intellectual property, customer, supplier and employee data and information systems from cybersecurity risks and maintain an active cybersecurity risk management program.

companyName: BROADWIND, INC.

ticker: BWEN


text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We work to align to the National Institute of Standards and Technology (NIST) 800-171 Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information system professionals and third-party providers monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.


text: We also engage consultants and other third -party advisors to conduct independent assessments of our cybersecurity readiness and control effectiveness. In collaboration with our third -party providers, we seek to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices to inform our cybersecurity response.


text: Management plays a critical role in assessing and managing material risks from cybersecurity threats. Our Director of Information Technology leads an internal team and works directly with our third-party information security professionals to manage our cybersecurity risk management program and activities. This includes monitoring our information systems for cybersecurity threats, reviewing cybersecurity incidents, analyzing emerging threats, and the development and implementation of risk mitigation strategies.


text: Our Director of Information Technology reports directly to our executive leadership team on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology team, led by the Director of Information Technology, meets regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, disaster recovery plans, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, and penetration testing.

companyName: PlayAGS, Inc.


text: The Board of Directors exercises direct oversight of strategic risks to the Company. The Board has delegated the responsibility for cybersecurity oversight to the Audit Committee. The Audit Committee's responsibilities include reviewing and discussing with management the strategies, process and controls pertaining to the management of information technology operations, including cybersecurity risks and information security. The Director of Information Technology reports to the Audit Committee annually and more frequently, as needed, on cybersecurity matters, including the cybersecurity threat landscape, key metrics demonstrating the overall management of our cybersecurity risk and risk management program, related key initiatives, enterprise program framework alignment, annual risk mitigation strategy, and review of cybersecurity incidents. Our Board is committed to maintaining a well-informed and cybersecurity-aware posture, engaging through regular and requested updates on our strategy and evolving threat landscape.


text: The Sponsor has an information security program and policy in place, as mandated by New Regulation S-K Item 106. The Sponsor engages Align to provide fully outsourced IT services, including 24x7x365 support, cybersecurity monitoring, and disaster recovery. Align's services encompass Office365 security features such as anti-phishing, encryption, and advanced threat protection, alongside endpoint security via Microsoft Entra ID and Intune, enforcing policies like MFA, BitLocker encryption, and geo-blocking. This program is designed to assess, identify, and manage material risks from cybersecurity threats. Regular reviews of cybersecurity and information technology plans are conducted for key service providers, as part of the Sponsor's disaster recovery and business continuity planning process. Additionally, the Sponsor evaluates whether any cybersecurity threats, including those resulting from previous incidents, have materially affected or are reasonably likely to materially affect the Trust and the Funds.

companyName: Teucrium Commodity Trust

ticker: CANE


text: Management provides oversight of cybersecurity risks, ensuring alignment with regulatory requirements and industry best practices. Management also plays a crucial role in overseeing the implementation and effectiveness of cybersecurity measures.


text: Furthermore, the Sponsor conducts regular training sessions for all employees, covering various cybersecurity topics, and disseminates real-time information on cybersecurity matters, as necessary. The information security plan undergoes periodic reviews and updates, at least annually, to adapt to evolving threats and changes in the operating environment, ensuring its continued effectiveness in safeguarding sensitive information and mitigating cybersecurity risks.


text: Risk Management and Strategy As part of our operational risk management strategy, led by our chief operating officer, we have implemented processes to assess, identify, and manage material risks facing the Company, including from cybersecurity threats. Components of this strategy includes the use of industry standard traffic monitoring tools, training users to detect, report, and prevent unusual behavior, and working with reputable service providers capable of ensuring their ability to operate with strategies equal to or better than our own. The implementation and management of these processes are integrated with the Company's overall operational risk management processes that seeks to limit our exposure to unnecessary risks across our operations. For cybersecurity threat management and mitigation, the Company engages with expert consultants and third party services providers for the design and implementation of these industry standard strategies to identify any potential threats or vulnerabilities in our system. We have developed a cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the Company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents.

companyName: Comstock Inc.

ticker: LODE


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner. See Item 1A: Risk Factors above for additional information on risk related to cyber attacks.


text: Role of the Board The Audit and Finance Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity, and are integrated into the Company's Cybersecurity Incident response process. Our chief operating officer is responsible for reporting to the Audit and Finance Committee on our incident response plan, which includes an evaluation of cyber risks and threats, and notifies the Audit and Finance Committee of a cybersecurity threat. In the event of an incident, the Audit and Finance Committee reviews and approves the material incident disclosure plan and recommendation for determination of materiality using the guidelines approved by the Audit and Finance Committee. The Board of Directors and Audit and Finance Committee receive regular updates throughout the year on cybersecurity.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information technology team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and reports to the audit committee of the Board of Directors, which evaluates our overall enterprise risk.


text: Role of the Management Our chief operating officer, together with our principal accounting officer, is responsible for the day-to-day management of our cybersecurity risks. We have an incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the chief operating officer, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. The chief operating officer activates the incident response plan to assess and mitigate a cybersecurity incident. In the event of an incident, the chief operating officer and principal accounting officer consult with cybersecurity consultants and other involved parties to identify the undesirable effects of the cybersecurity incident and develop a material incident disclosure plan for review and approval by the Audit and Finance Committee.


text: Risk Management and Strategy We have certain processes in place to assess, identify and manage material cybersecurity risks. We also periodically monitor and test our information systems for potential vulnerabilities. We use various tools designed to help identify, investigate and resolve cybersecurity incidents, and to help recover from them in a timely manner. These processes, policies and tools comprise our cybersecurity risk program and are integrated into our overall risk management program.

companyName: Contineum Therapeutics, Inc.

ticker: CTNM


text: We have implemented cybersecurity processes in accordance with our risk profile and business size and we are continually seeking to improve processes to enhance our risk management processes. Currently, we engage external resources that contribute to our existing cybersecurity practices and organizational risk assessment systems. For example, we have an employee training program that includes annual cybersecurity awareness training that is reinforced by approximately quarterly phishing campaigns.


text: In order to help protect us from any related cybersecurity vulnerabilities, we take a risk-based approach to the evaluation of third -party providers with whom we engage and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the third -party service provider's programs.


text: In fiscal 2024, and through the filing of this Annual Report on Form 10-K, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our management team, including our Chief Financial Officer, and our external information technology service provider are responsible for assessing and managing our material risks from cybersecurity threats. We have outsourced implementation and day-to-day function of our overall cybersecurity risk management program to our third-party information technology service provider. Our management team supervises both our internal personnel and our third-party information technology service provider.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from the finance department or external information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our Board of Directors has delegated oversight of cybersecurity risk management to the Audit Committee. The Audit Committee reviews our major cybersecurity risk exposures and the steps that our management has taken to monitor and control such exposures. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary or appropriate, regarding any material cybersecurity incidents.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted software as a service vendors, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our production server environments (collectively "Information Systems and Data").


text: Our information technology team with oversight from our Chief Financial Officer as well as specific resources that manage our production server environment help identify, assess and manage the Company's cybersecurity threats and risks. The team includes credentialed professionals whose experience and current duties include the identification and management of cyber risks. Our information technology team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, internal and external audits, third party threat assessments, conducting vulnerability assessments, use of external intelligence feeds, subscribing to reports and services that identify a cybersecurity threats, and evaluating threats reported to us.


text: In the last three fiscal years, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition, and the expenses we have incurred from cybersecurity incidents were immaterial. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the following:


text: We rely on information technology and other systems and any failures in our systems could disrupt our business and adversely impact our results.


text: Due to the ever-changing threat landscape, our operations and services may be subject to certain risks, including hacking or other unauthorized access to control or view systems. Our business is dependent on the security and integrity of the systems and products we offer.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Chief Financial Officer.


text: Our executive team including our Chief Executive Officer, Chief Financial Officer and Chief Business and Legal Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer and Chief Business and Legal Officer. Our information technology team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the Board of Directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems.


text: The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We rely on our technology infrastructure and information systems for our internal communications, controls, reporting and relations with customers and suppliers, to utilize our data, and to bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed system and processes, as well as those systems and processes provided by third -party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. In response to the increasing threats presented by cyber incidents, in 2023 we established a Cybersecurity Steering Committee, which meets bimonthly. This committee is comprised of our Head of IT and Security Leader, along with our Deputy General Counsel who reports to our General Counsel. The Cybersecurity Steering Committee oversees activities related to the monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The Cybersecurity Steering Committee develops and implements cybersecurity risk mitigation strategies and activities, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors, ensures policies and procedures are current and followed, and receives regular updates on cybersecurity-related matters.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: Our Board of Directors oversees our enterprise risk management process and our Audit Committee of the Board has direct oversight of our management of cybersecurity risks. Under the direction and supervision of our Chief Financial Officer, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. The Board of Directors receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks. Our Cybersecurity Steering Committee reviews the results of any enterprise risk assessment with management on a bimonthly basis and with the Board of Directors quarterly or when risks are identified. Management provides a comprehensive update to the Audit Committee of the Board on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant.


text: Our Head of IT, reporting to our Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the activities and systems necessary to address such risks and threats and preparing updates for the Board of Directors. Our Head of IT has over 20 years of IT experience, including over 10 years experience in cybersecurity, data security and regulatory compliance. Our Security Leader reports to our Head of IT and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Security Leader has 20 years of IT experience.


text: We have adopted the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security Critical Security Controls to continually evaluate and enhance our cybersecurity. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third -party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout our organization. These cybersecurity drills are performed both in-house and by a third -party service provider. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. Our Cybersecurity Steering Committee also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cybersecurity Steering Committee escalates events, including to the Chief Financial Officer, Audit Committee and Board of Directors, as relevant, according to pre-defined criteria.


text: If we were to experience a cybersecurity incident, our Security Leader would inform the Cybersecurity Steering Committee, which would then evaluate and assess the materiality of the incident to the Company and the impact of the incident on the Company's information technology infrastructure and data integrity, and determine whether the incident should be reported to the Audit Committee of the Board in advance of the next regular cybersecurity update. The Cybersecurity Steering Committee, with the assistance and input of the Audit Committee of the Board, has established a set of predefined criteria that it uses to make such determinations. Once a cybersecurity incident has been reported to the Audit Committee of the Board, the Audit Committee of the Board, with the input of the Cybersecurity Steering Committee, will determine how to address it.


text: We engage subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Cybersecurity Steering Committee oversees and establishes the parameters of our engagement with these experts to ensure we obtain supplement assistance needed in this area, if any.


text: If we were to experience a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Security breaches of our systems which allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information, belonging to us or to our employees, providers, suppliers, customers or insurance companies could result in our suffering significant financial and reputational damage. Though we take steps to ensure our products and software are secure, a cyber-attack could result in the loss or compromise of our or our employees', suppliers' and customers' critical data. If a supplier or customer alleges that a cyber-attack causes or contributes to a loss or compromise of critical data, whether or not caused by us, we could face harm to our reputation and financial condition and incur regulatory repercussions. See Item 1A "Risk Factors – Security and privacy breaches may expose us to liability and cause us to lose customers". A cybersecurity incident could materially harm our reputation and financial condition and cause us to incur legal liability and increased costs when responding to such events.


text: The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. Our cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Risk Management and Strategy The Company and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third -party security firm to provide threat detection and reports, conduct annual testing of our systems, train our employees and generally advise on cybersecurity processes. At least annually, our information technology team makes a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and employees, and the latest threats that have emerged, including a presentation from the third -party security firm.


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our information technology team and a third -party security firm.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third -party security firm, the Company has implemented several layers of physical security, digital security and data backup.


text: Incident Response and Recovery Planning: The Company has established a comprehensive incident response and recovery plan that addresses the response to a cybersecurity incident and plans to test and evaluate that plan on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third -party systems.


text: Education and Awareness: A third -party security firm provides training to our employees, helping our information technology team to maintain a state-of-the-art cybersecurity system and staying up to date on the latest threats and counter measures available. The third -party security firm places a high priority on employee threat education through automated internal phishing tests. Our information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last three years on information security breaches. However, the Company faces certain ongoing risks from cybersecurity that, if realized, could materially affect the Company. See "Item 1A. Risk Factors - The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations." There can be no assurance that the Company's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency MBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives periodic reports from management, the information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate. Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. The Company maintains a comprehensive risk-based cybersecurity program to identify, measure, manage, and disclose material cybersecurity risks. The Company utilizes the Federal Financial Institution Examination Council's ("FFIEC") Cybersecurity Assessment Tool ("CAT") as a diagnostic test to help identify the Company's cyber risk level and determine the maturity of our cybersecurity program. The CAT is supplemented by an annual self-assessment and external audits and reviews, the results of which drive the development and implementation of the Company's cybersecurity strategy to ensure that cyber risk management practices are aligned with the risk profile of the Company.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: The Company uses the Center for Internet Security ("CIS") Critical Security Controls framework to balance cybersecurity risk exposure with investment in mitigation strategies. This framework provides a prescriptive, prioritized set of cybersecurity safeguards that fully align with those of the National Institute of Standards and Technology, the International Standards Organization 27000 series, and the requirements and guidance from applicable regulatory authorities, including the Federal Financial Institutions Examination Council.


text: The Company's cybersecurity strategy is enabled by people, processes, and technology that provide multilayered defenses including advanced capabilities for early and rapid cyber threat identification, detection, protection, response, and recovery. The Company employs a team of dedicated, skilled talent to operationalize the cybersecurity strategy. The internal team is supported by arrangements with a third party to provide continuous endpoint monitoring and incident response.


text: The Company's entire workforce receives mandatory cybersecurity training that includes quarterly social engineering exercises and informative online courses assigned based on assessed skill gaps. The Company also provides cyber risk awareness guidance to customers and promotes customer cyber hygiene through periodic communications. The Company conducts scenario-driven test exercises simulating impacts and consequences developed through analysis of real-world cybersecurity incidents as well as known and anticipated cyber threats. These exercises are designed to assess the viability of the Company's incident response and management programs and provide the basis for continuous improvement.


text: The Company actively monitors and evaluates threats, events, and the performance of its business operations and continually adapts its risk mitigation activities accordingly. To that end, the Company maintains a comprehensive vulnerability management program that includes regular internal scans of the entire network to identify and measure the severity of security vulnerabilities, a team of dedicated network engineers who are responsible for fixing identified vulnerabilities within pre-defined timeframes based on severity, and at least annual independent network penetration testing by a qualified third party.


text: Cyber risk monitoring also includes the Company's arrangements with and exposure to third party service providers. We identify the criticality of our third -party service providers, in part, by determining their use of and access to confidential customer information. We conduct comprehensive cybersecurity reviews on all third parties that have access to confidential information. Our third -party reviews make use of technology that provides significant visibility into third party organizations, in real time, to assess third party compliance with a host of globally recognized IT security standards and frameworks and the likelihood of a cyberattack on a third party.


text: The Company also maintains a robust firewall system and firewall management program to restrict inbound and outbound network traffic. A dedicated team of network engineers manages firewall rulesets and monitors firewall health and alerting.


text: The risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations, or financial condition. Although the Company has invested substantial resources to manage and reduce cybersecurity risk, it is not possible to eliminate this risk. The Company obtains insurance that protects against certain losses, expenses, and damages associated with cybersecurity risk. See Item 1A, "Risk Factors," for additional information regarding cybersecurity risk.


text: Cybersecurity Governance The Company's Board of Directors devotes significant time and attention to its oversight of cybersecurity risk. Select members of the Board serve on the Information Systems Steering Committee ("ISSC"), which is responsible for approving IT strategic plans and all IT-related policies and for oversight of the information security program, among other matters. To fulfill its responsibilities, the ISSC receives periodic reports on the cybersecurity risk management program, including information security risks and incidents, emerging threats, and both internal and independent audit reports on the effectiveness of the control environment.


text: Our incident response plan documents the procedures for assessing and managing cybersecurity events. This plan includes protocols for identifying the nature and scope of a cybersecurity threat, including whether it originates from a third -party provider, and assessing its potential impact. Our incident response team includes senior personnel, including the general counsel, and the heads of human resources and information technology, as well as our cybersecurity senior manager. Any material cybersecurity events are reported to our Board. In addition, employees are provided with online training courses to build awareness around potential cybersecurity threats and are tested periodically to maintain their focus in this important area.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: Executive leadership is responsible for management of the cybersecurity program. The IT Security Director supervises daily operations of the cybersecurity program and reports directly to the Chief Risk Officer ("CRO"). The CRO chairs the Information Security Sub-Committee ("Sub-Committee"), a management committee that meets at least monthly to receive regular updates on the status of the cybersecurity risk management program and strategic cyber initiatives. The Sub-Committee's actions and activities are reviewed by the ISSC at least quarterly. The Company has a management level Change Control Board ("CCB") which is responsible for reviewing and approving actions of the vulnerability management team, changes to hardware/software including the introduction of new hardware/software, and changes to firewall rulesets. The IT Security Director serves as a voting member of the CCB. Additionally, the Company has a Cyber Incident Response Team ("CIRT") which includes key members of management including the CRO and IT Security Director. The CIRT manages significant cyber-specific events with escalation up to executive leadership and the Board.


text: The CRO, Derek Bonnett, has been employed by the Corporation since 2016, having served as the Director of Internal Audit until being named the Chief Risk Officer in 2021. He has over fourteen (14) years of experience providing risk management advice, insight, and assurance to financial institutions.


text: Mr. Bonnett is a Certified Public Accountant, Certified Internal Auditor, and Certified Information Systems Auditor. He holds a Bachelor of Science in Business Administration with a concentration in Accounting obtained from Concord University in 2010, from which he graduated valedictorian of his class. He is a recipient of the Executive Leadership Certificate from the University of Pennsylvania's Wharton School of Business and is a graduate, volunteer, and Capstone Advisor to students of the American Bankers Association's Stonier Graduate School of Banking.


text: The IT Security Director has over 9 years of experience leading the Bank's IT Security program. The Director has a Bachelor of Science in Software Engineering and Computer Science from Radford University and is a member of the Association of Information Technology Professionals. His credentials include experience and competency with several different programming languages and a multitude of software.


text: HighPeak Energy maintains a cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including internal risk assessment and policy implementation, to incorporate a risk-based cybersecurity framework to identify, monitor and mitigate security threats and other strategies to increase security for our information, facilities, and infrastructure.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: Risk Management and Strategy The Company recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an important component of our overall risk management strategy. HighPeak Energy's cybersecurity team consists of certain of our executive officers, as well as internal and third-party cybersecurity personnel, with cybersecurity expertise across multiple industries. The cybersecurity team takes a cross-functional approach to addressing these risks and engages in discussions with the Board and our executive management team on an as-needed basis.


text: We have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. We also require our employees and contractors to receive annual cybersecurity awareness training. We perform cybersecurity tabletop exercises to test the effectiveness of our incidence response plan ("IRP") and implement post-incident "lessons learned" to enhance our response. We provide our system users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information. We use encryption methods to protect sensitive data. This includes the encryption of our customer data, financial information, and other confidential data. We have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.


text: Third parties also play a role in the Company's approach to cybersecurity and its associated risk management framework. HighPeak Energy leverages technological tools and partners with the goal of augmenting and enabling the efforts of its internal cybersecurity team. Separately, our internal auditing processes include processes to identify, manage and oversee the risks from cybersecurity threats associated with our engagement of third-party service providers. In connection with and pursuant to the IRP, our incident response team, made up of management, employees and third-party cybersecurity personnel, works collaboratively across HighPeak Energy to carry out a program that has been designed to protect our information systems from cybersecurity threats, assess and manage risks arising from any such threats, and to respond to potential cybersecurity incidents.


text: We have an IRP that delineates the procedures to be followed for handling a variety of cybersecurity incidents; categorizes potential cybersecurity incidents and the required timeframe for reporting each; establishes cybersecurity incident response levels; provides for investigations designed to help us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident.


text: The Board, in coordination with the Audit Committee, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the Audit Committee include overseeing policies and management systems for cybersecurity matters and reviewing HighPeak Energy's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the Audit Committee receive regular presentations and reports on cybersecurity risks that address a range of topics, including developments, technological trends or tools, third party updates, and regulatory standards. The HighPeak Energy IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity with our executive officers and cybersecurity personnel.


text: Management plays a role in assessing and managing our material risks from cybersecurity threats through membership on our cybersecurity team, as well as by making final materiality determinations and disclosures and other compliance decisions, as reflected in the HighPeak Energy IRP. Our cybersecurity team is made up of experienced professionals, both employees and third parties with extensive backgrounds in information security, risk management, and incident response. This team is lead by an officer of the Company, bringing over a decade of experience in IT leadership, policy development, and technology strategy. With a strong background in overseeing IT departments and driving digital transformation, the team plays a critical role in ensuring the security, efficiency, and innovation of our technology infrastructure. Cybersecurity remains a top priority, with a focus on risk management, regulatory compliance, and safeguarding company data. Our cybersecurity team regularly interacts with the Board of Directors and the Audit Committee, providing insights on IT governance, cybersecurity initiatives, and emerging technology trends.


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Despite the implementation of our cybersecurity processes, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors" for additional information.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, clinical trial data, customer data, manufacturing data, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: UroGen Pharma Ltd.

ticker: URGN