text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote internal and external resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Allakos Inc.

secItem: Item 1C


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report, including the risk factors entitled "We may experience disruptions and delays or incur financial damages as a result of system failures or security breaches or incidents" and "If we fail to comply with applicable U.S. and foreign privacy and data protection laws and regulations, we may be subject to liabilities that adversely affect our business, operations and financial performance".


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Financial Officer, in conjunction with our information security team and third-party consultants, is primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Financial Officer provides briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In addition, our Chief Financial Officer provides briefings of any significant cybersecurity matters to the Board of Directors as well as an annual update of cybersecurity risks and activities.

stage1Category: Board Governance

stage1Method: majority


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: StandardAero, Inc.

ticker: SARO


text: Our organization's cybersecurity program is informed by industry standards and industry-recognized practices, such as the NIST Cybersecurity Framework, ISO 27001, and CIS Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such industry standards and practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This helps us align with the specific requirements of diverse regulatory environments and industry benchmarks without compromising on security or efficiency.

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: • Risk Governance – A structured set of cybersecurity policies, standards and guidelines, including incident response and disaster recovery procedures, to help the organization meet compliance and business goals. We update policies periodically based on evolving regulatory and threat landscapes. • Risk Identification – We leverage a set of tools designed to identify cyber security risks and manage vulnerabilities according to impact and likelihood. • Risk assessments - Designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • Risk Response - A security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents. • External Service Providers - We utilize external service providers, where we consider appropriate, to assess, test or otherwise assist with aspects of our security controls. • Risk Monitoring and Review – Monitoring of threats through threat intelligence feeds and security tools, the use of a Security Information and Event Management (SIEM) system for real-time detection, and periodic reassessments of risks as technology and threat landscapes evolve. • Training and Awareness – A dynamic role-based cybersecurity awareness training of our employees, incident response personnel, and senior management; • Incident Management – Protocols that are designed to respond to cybersecurity incidents, including procedures for response, containment, eradication, and recovery. • Integration with Business Strategy – Cybersecurity risk considerations are factored into key business decisions and strategies, and cybersecurity initiatives are aligned with organizational risk appetite and priorities.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") the oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our VP of Information Security, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The management team, led by one of our Vice Presidents for Information Security and our SVP of Information Technology is primarily responsible for assessing and managing risks from cybersecurity threats.

stage1Category: Management Role


text: • Our VP of Information Security is responsible for leading the organization's information security program, strategy and ensuring the protection of digital assets. He has over 20 years of information technology experience, including leadership experience managing global information security, IT infrastructure and networking, experience designing comprehensive cybersecurity programs and managing and mitigating high profile cybersecurity incidents to ensure best information security practices and business continuity. Additionally, he has previously served as the CISO for the City of Plano, Texas at municipal government level and as the Information Security Principal performing various strategic and technological tasks with DynCorp International. He holds a Bachelor in Economics from University of San Buenaventura, Cali, Colombia and a Master of Science in Computer Information Systems with a concentration in Security from Boston University. • Our Senior VP of Information Technology is also responsible for oversight of our information security strategy, program, and operations. He has over 20 years of information technology experience, including leadership experience managing global information security, IT infrastructure and engineering. In the past, he has served in roles as Lead Technologist for Hewlett-Packard and as Global Product Manager for the Procter and Gamble Company. He holds a Bachelor of Science degree in Computer Engineering from Universidad Sim n Bol var, Venezuela, an MBA in International Business from Xavier University and a Master of Science degree in Computer Science from University of Southern California.


text: The management team also includes Technology SME's, Legal advisors, Business Unit leaders, HR representatives and Finance representatives to further assist our VP of Information Security and SVP of Information Technology with assessing and managing our material risks from cybersecurity threats.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We are cognizant of the evolving risks associated with cybersecurity and recognize a material cybersecurity incident could adversely impact our financial results and condition. We further recognize the importance of maintaining processes to identify, mitigate, and manage those cybersecurity threats. No cybersecurity threats occurred during the year ended December 31, 2024 that have had, or are reasonably likely to have had, a material impact on our business strategy, results of operations, or financial condition. However, if as a result of any future attacks, our information technology systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity breach, we may suffer an interruption in our ability to manage and operate our business, and our business strategy, results of operations or financial condition could be adversely affected. Such attacks, whether or not successful, could result in significant costs related to, for example, repairing or replacing our IT systems; the loss of critical data; and interruptions or delays in our ability to perform critical functions. In addition, the volume, frequency and sophistication of these threats (including through the use of artificial intelligence) continues to grow and the complexity and scale of the systems to be protected continues to increase.

companyName: FreightCar America, Inc.

ticker: RAIL

stage1Category: Strategy Integration


text: We utilize the National Institute of Standards and Technology ("NIST") framework with our security program to identify, mitigate, and manage cybersecurity risks. We have implemented controls and a formal security policy following this framework. This security policy functions in conjunction with other policies, such as our acceptable use policy and our mobile device policy. We also maintain a specific incident response policy and procedure document including notification and participation of key workforce personnel and external stakeholders to contain, eradicate, and recover from any security incidents.


text: The Company emphasizes the importance of security awareness to our workforce through the administration of third-party cybersecurity training and prioritizes the monitoring and prevention of unauthorized access to Company information technology ("IT") assets such as networks, computers, mobile devices, applications, and stored information. Our internal IT team considers cybersecurity capabilities of third-party service providers prior to engaging them and on an ongoing basis. Our key external IT vendors provide the Company with system and organizational control reports that are reviewed by our internal IT team and may reveal potential security risks.


text: A third-party managed security services provider ("MSSP") works in tandem with our internal IT team to implement and maintain processes and procedures to detect and handle identified security incidents, including the performance of phishing simulations to evaluate our workforce's ability to recognize malicious emails. Our MSSP team leaders have significant experience working in cybersecurity and employ a trained workforce designed to provide proactive and comprehensive cybersecurity care. Together with our MSSP, we also monitor the frequency and extent of cybersecurity threats and update our processes and procedures as necessary. On an annual basis, our internal auditors conduct penetration testing and other assessments.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee primary responsibility for oversight of our risk management programs, including processes and procedures related to cybersecurity threats and incidents. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Company's cybersecurity risk management program is under the direction of our Director of IT, who reports directly to our Chief Financial Officer and has over two decades of experience in the field of information technology and security. Our Director of IT drives collective focus and central coordination of our cybersecurity risk management program internally and oversees our retained external MSSP personnel. Management reports to the Audit Committee, at least quarterly, and more frequently if needed, on the Company's cybersecurity risk management program, including periodic assessments and tests addressing cybersecurity threats and incidents.


text: Risk Management and Strategy Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis and at least annually.

companyName: PHX MINERALS INC.


text: Our Board has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Accounting Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to the Audit Committee, which consists of 100% independent directors, and ultimately to our Board. Management presents an assessment of our cybersecurity processes, procedures, and results of testing to the Audit Committee at least annually.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – We may be subject to information technology system failures, network disruptions, cyber-attacks or other breaches in data security." in this Form 10-K.


text: Our Company recognizes the importance of maintaining the safety and security of our critical systems, information, and broader information technology environment. We have developed a comprehensive cyber, data governance, and privacy program intended to (i) protect the confidentiality, integrity, and availability of our information systems and data, and (ii) assess, identify, and manage materials risks associated with cybersecurity threats In order to protect the Company data - and any other data we manage or handle - we have adopted a number of safeguards and security measures. For example, we have implemented software-as-a-service firewalls, endpoint protection, detection and response solutions, intrusion detection systems, access controls including multi-factor authentication, vulnerability scanning, software static analysis, dynamic analysis, third-party independent business continuity testing, independent third-party control audits. In addition, we have implemented several policies and programs to improve compliance and reduce risk, ensure appropriate responses in the event of an incident, and reduce the cost and scope of an incident should it occur, including: • a robust Incident Response Plan ("IRP"), • an Information Technology and Information Security Policy ("IT&IS Policy"), • a data governance program to oversee our Records Retention Policy, • a Data Governance Working Group comprised of legal, finance, human resources ("HR"), and third-party privacy and data governance consultants to review policies, programs, and data governance, and make reports and recommendations to management and the Board of Directors, • mandatory cyber and information security training for all employees, and • cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents Our IRP, in conjunction with the IT&IS Policy, is designed to equip our employees and managers with the necessary tools to detect, respond to, and ultimately prevent cybersecurity incidents. It contains detailed processes and procedures to assist employees in managing cybersecurity incidents when they happen, including techniques for detecting/identifying suspicious activity in our data environment, response and escalation protocols to defend against intrusions and contain any potential data leakage, data preservation measures to ensure data integrity going forward, and remediation steps to diagnose root causes and secure gaps to prevent future attacks.

companyName: ContextLogic Inc.


text: The Incident Response Team ("IRT") coordinates and aligns key resources and team members during a security incident to minimize impact, restore operations as quickly as possible, and assess and fulfill the Company's legal and contractual obligations. The IRT is also responsible for centrally managing internal and external communications to ensure that disclosures are accurate and complete. The IRT is led by our Chief Compliance Officer, legal team, and Cybersecurity Response Leader, and is supported by a multi-tier team comprised of key stakeholders across the business including finance, HR, our dedicated IT provider, and other external response partners, including cybersecurity consultants, cybersecurity insurance providers, and outside legal counsel. The IRT and external response partners operate under the supervision of our executive management team with oversight from the Audit Committee of our Board of Directors.


text: Finally, the IRP is also supported by a full curriculum of training for employees that is drafted and administered under the supervision of our Chief Compliance Officer. Importantly, these training sessions include several modules and quizzes for both technical and non-technical employees to assist our employees in comprehensively understanding the importance of data security to our stakeholders and our business and the various ways they can promote a security environment throughout our company.


text: Annual Cybersecurity Plan. This plan is provided for the first quarter Audit Committee meeting and outlines the cybersecurity related strategic initiatives for the fiscal year. It outlines any new investments and projects and their alignment with the cybersecurity framework, as well as the expected timelines for the implementation of these activities.

companyName: Zumiez Inc

ticker: ZUMZ


text: Risk Management and Strategy Incident Response Lifecycle - Assessing and Responding to Cyber Incidents Our IRP sets forth the Company's process for assessing cyber threats. The IRP serves as the incident response plan to effectively manage, mitigate, and contain the risk of a security incident or data breach and it applies to all ContextLogic personnel, including employees, contractors, consultants, and any other individuals acting for or on behalf of the Company. The IRP incident response lifecycle is comprised of four phases: (1) Preparation, (2) Detection and Analysis, (3) Incident Response, Investigation, and Notification, and (4) Post-Incident Analysis and Lessons Learned.


text: The preparation phase of our IRP includes maintaining protective measures to minimize the likelihood and impact of a security incident, regularly reviewing and updating our policies and procedures to maintain alignment with industry standards and guidance, and periodic training of all Company personnel on information security, data privacy, and the procedures to reporting suspected incidents.


text: The detection and analysis phase addresses the responsibility of Company personnel to notify our IRT Leader and IT provider upon noticing, suspecting, or being notified of any actual or suspected security incident which will prompt our IT provider to perform an initial investigation of the issue and determine whether the event is a security incident and whether the Cybersecurity Response Leader needs to be notified.


text: The incident response, investigation, and notification phase of our IRP addresses the distinct but simultaneous workstreams that occur internally once an event has been determined to be a security incident. This includes technical response such as technical evidence collection and preservation, thread containment and eradication, and system and data restoration. Additionally, incident investigation efforts begin to determine the scope and severity of the security incident with legal and finance stakeholders. If appropriate, further measures are taken to comply with disclosure obligations as required by governance guidelines, committee charters, and applicable laws and contracts.


text: The post-incident analysis phase includes evaluating the internal security policies, preparedness, posture, and technical environment, allowing the Company to conduct a holistic assessment and identify and remediate shortcomings and gaps.


text: As part of our IRP, we conduct regular testing to ensure that the IRP is functional and effective. Tests may include tabletop exercises, verbal walkthroughs with relevant stakeholders, or responses to actual security incidents.


text: We also engage third-party services from time-to-time to conduct evaluations of our security controls, including the IRP, whether through business continuity testing, or consulting on best practices to address new challenges and risks.


text: Board and Management Oversight The Company's management is involved in overseeing our cyber, data governance, and privacy program as members of our Data Governance Working Group, and assessing security incidents with the IRT to the extent discussed in the IRP above. The Board and Audit Committee actively oversee our enterprise risk management, including cybersecurity risks, and are notified and updated on any security incidents on a regular basis. The Audit Committee is responsible for overseeing our cyber, data governance, and privacy program and receives regular updates from management and the IRT leader about the Company's ongoing compliance and risk management and reports to the Board regularly.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us.


text: Cybersecurity Risk Management and Strategy The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on Diameter and other service providers to protect the Company's information from cybersecurity threats. Diameter has processes in place to assess, identify, and manage material risks from cybersecurity threats, including pursuant to its Written Information Security Policy ("WISP") and Cyber Incident Response Plan ("CIR Plan", and together with the WISP, the "Plans"). Diameter utilizes a third-party managed service provider to support and manage its information technology framework.

companyName: Diameter Credit Co


text: The Plans promote the Company's cybersecurity infrastructure through policies and procedures relating to, among others, employee responsibilities, data loss prevention, access controls, cyber risk assessments and management, reporting requirements, and electronic communications. Pursuant to the Plans, Diameter also engage s external parties as it deems appropriate, including cybersecurity consultants to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the expertise of legal, information technology and compliance personnel of Diameter and external cybersecurity consultants when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: Since the Company's inception, it has not experienced a cybersecurity incident that has materially affected the Company, its business strategy, its results of operations, or its financial condition.


text: Board Oversight of Cybersecurity Risks Diameter's Chief Compliance Officer, or a designee, reports to the Board periodically, and at least annually, an overview of the Adviser's cybersecurity structure and any material cyber incidents that occurred with respect to the Company or the Adviser since the last report. Diameter's Chief Compliance Officer may, in his or her discretion, update the Board regarding Diameter's cybersecurity program in addition to those periodic reports, including providing notice of material cybersecurity incidents that have occurred.


text: Management's Role in Cybersecurity Risk Management Diameter's Chief Compliance Officer and Chief Operating Officer oversee Diameter's cybersecurity operations, with the assistance of additional personnel and Diameter's external managed service provider. Employees that support Diameter's cybersecurity infrastructure have relevant educational and industry experience, including in technology and cybersecurity risk. Assessment of Cybersecurity Risk Diameter conducts annual cyber risk assessments, and penetration tests are conducted by third-party service providers.


text: All network environment alerts are reviewed by the third-party SOC team then relayed to Diameter's appointed technology infrastructure employee and its external managed service provider. Pursuant to the CIR Plan, cyber threats will be assessed for their threat level and the appropriate parties will be alerted.


text: Cybersecurity Program Overview AGL Private Credit Income Fund has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of AGL US DL Management LLC (the "Adviser") and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: AGL Private Credit Income Fund


text: The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The board of trustees of the Company (the "Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Adviser's Chief Technology Officer ("CTO"), internal information technology team and a managed virtual security operations center are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The Adviser's CTO has 20 years of experience in technology, with 10 years advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Adviser's CTO works closely with Company management to administrator, assess, discuss, and prioritize the Company's cybersecurity efforts.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents (of which there were none), that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature such as data about our research and clinical trials (the Information Systems and Data).

companyName: SCYNEXIS INC

ticker: SCYX


text: Our information security function, which includes our information technology Managed Service Provider (MSP), helps identify, assess and manage the Company's cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including: manual and automated tools; subscribing to and analyzing reports and services that identify cybersecurity threats; evaluating threats reported to us; and conducting vulnerability assessments.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response process; disaster recovery/business continuity plans; encrypting certain data; using network security controls; maintaining access controls; managing assets; and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) we prioritize our risk management processes to include mitigation of risks from cybersecurity threats that are more likely to lead to a material impact to our business; (3) management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example our information technology MSP.


text: We use third-party service providers to perform a variety of functions throughout our business, such as distributors and supply chain resources and contract research organizations (CRO) and contract manufacturing organizations (CMO). We have certain vendor management processes to manage cybersecurity risks associated with our use of certain providers, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. These processes may include information security questionnaires, assessments, and imposition of contractual obligations relating to cybersecurity.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors, through its Audit Committee, is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President, Human Resources & IT, who has over 22 years of human resources experience in various industries including in executive roles and has led our IT function since joining the Company. Management is responsible for budgeting, hiring appropriate cybersecurity personnel, and helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, and Vice President, Human Resources & IT, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from company management, including our Chief Legal Officer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy Talkspace recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats as a vital component to the success of our business. We have established policies and processes for assessing, identifying, and managing the material risk from cybersecurity threats which may include, among other things, operational risks; fraud; extortion; harm to our business, employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: Talkspace, Inc.

ticker: TALK


text: We routinely assess material risks from cybersecurity threats, which include unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing therein. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: We also have a cybersecurity specific risk assessment process, which helps identify residual risk from cybersecurity threats. Our risk assessments include the identification of reasonably foreseeable internal and external information security and cybersecurity risks, the likelihood that such events may occur and the impact or potential damage that could result from such risks. The assessments examine the adequacy of our policies, procedures, systems, and the safeguards in place to manage and mitigate the identified risks. The impact of these assessments is the refinement of existing safeguards and the implementation of new safeguards to improve our cybersecurity protections; reasonably address any identified gaps in existing safeguards; and ensure that we regularly monitor the effectiveness of those safeguards.


text: As part of the above processes, we engage with a third-party to review our information security program and related cybersecurity safeguards to help identify areas for continued focus, improvement, and/or compliance. Along with these third parties we ensure that the appropriate personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their impact and potential mitigations. We have implemented the following activities (among others) to mitigate risk: • Periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • Background checks prior to hire; • Encryption of data at rest and in transit; • Logging and event monitoring; • Threat detection to monitor for malicious activity and anomalous behavior; • Malware protection and restricting connections to malicious websites; • Data loss protection mechanisms; • Third party penetration testing and internal vulnerability assessments; • Cybersecurity risk assessments of our third-party vendors; • Reviews by internal and external audit of the effectiveness of information security-related internal controls; • Closely monitor emerging data protection laws and implement changes to our processes designed to comply as needed; and • Carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan, as implemented by management, coordinates the activities we take to prepare for, detect, contain, eradicate, and recover from cybersecurity incidents as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan also outlines the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Chief Technology Officer escalates material events, including to the Chief Executive Officer and Board.


text: We require all employees to participate in cybersecurity awareness, privacy, security training annually and provide mechanisms to report potential threats. In addition, we use a third-party phishing awareness vendor to increase employee awareness of cybersecurity threats.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers and we continually monitor cybersecurity threat risks identified through such diligence.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, have not materially affected our business to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, and more frequently as relevant, the Audit Committee receives an overview from management covering topics such as security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity risks are also considered during separate Board meeting discussions of important matters like risk management, and other relevant matters. Management or the Audit Committee will provide a comprehensive update to the Board on cybersecurity threats and risk mitigation generally at least annually, and more frequently as relevant.


text: The Company's information security and cybersecurity program is managed by our Chief Information Security Officer (CISO) and our Chief Technology Officer (CTO). The CISO and the Senior Director Information Security are responsible for our overall security and assessing and managing cybersecurity risks and threats. The CISO has over 20 years of information security, privacy, auditing and compliance experience and holds numerous certifications. The Senior Director of Information Security has over 15 years of experience in information security, and holds numerous certifications. The CTO has over 20 years of experience and leads our Company's information systems and technological advancements. The SVP of Engineering has over 20 years of experience in IT and has specialized knowledge in systems and network infrastructure. The Director of Site Reliability Engineering and Security has nine years of experience and has principal responsibility for our network operations and system administration.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: The Company has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, together with external consultants it engages, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's Cybersecurity Program.


text: The Company depends on and engages various third parties, including service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its reliance upon such third parties.


text: Third-party information security service providers, subject to the Investment Adviser's Technology Risk and Information Security Committee (the "Committee") and Company CCO's oversight, have been engaged to monitor and support the Investment Adviser and Company information security control environment and breach notification processes. The Investment Adviser's Committee, subject to the Company CCO's oversight, monitors developments in data privacy and security.

stage1Category: Third-Party Risk


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, as well as the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the Investment Adviser's Committee, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's Chief Financial Officer, CCO, General Counsel, Chief Operating Officer, and Director of Information Technology. The CCO has been responsible for oversight of the Company's overall SEC compliance program, since the Company's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and overseeing controls regarding risks applicable to the Company.


text: The Company's Senior Management team, including the CCO, is regularly informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats posed to the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: BC Partners Lending Corp


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program, overseen by the Adviser's Global Head of Infrastructure & Cybersecurity ("GHIC"), which is designed to assess, identify, and manage material cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and other specialists as appropriate to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.


text: The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments. The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company takes steps to identify and oversee risks from cybersecurity threats associated with our use of such entities and the Chief Compliance Officer ("CCO") of the Company reviews cybersecurity-related reports provided by key service providers.


text: Board Oversight of Cybersecurity Risks The Board would be made aware of any material risks associated with cybersecurity threats. The Board currently receives periodic updates from the Company's CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO, in managing such risks relating to cybersecurity threats, relies on the assistance provided by the Adviser's GHIC. The Adviser's GHIC has extensive experience in managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since 2021 and has worked in the financial services industry for more than 15 years, during which the CCO has gained expertise in assessing and managing such risks applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk Management and Strategy Management of cybersecurity risks is an integral part of our overall risk management framework and is essential for safeguarding our business and data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Village Farms International, Inc.

ticker: VFF


text: Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls and intrusion detection and prevention, and vulnerability and patch management.


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating training programs for our entire workforce. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. • Proactive Reporting and Investigation: As part of our training initiatives, we educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.


text: We engage a variety of third-party service providers to process and store data, including certain customer information, some of which may include personally identifiable information. We also depend on third-party service providers to host many of the systems and infrastructure used to provide our products and services. A limited number of third-party services support essential functions of our business, including the use of cloud-based technology.


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee oversees major enterprise risks, and the steps management has taken to monitor and control such exposure, including risks to our information technology infrastructure and security. The Audit Committee is responsible for ensuring independent examination of management's programs to identify, assess, respond to and monitor risks, which include those performed by third party consultants. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.


text: Our cybersecurity programs are managed by a team of professionals who monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP), as well as experienced information systems security professionals and information security managers.


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize, or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2024 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "We face risks related to cyber security attacks and other incidents."


text: Cybersecurity Risk Management and Strategy The Company, under the oversight of the audit committee of the board of directors, has implemented and maintains an enterprise risk management program that includes a cybersecurity risk management program designed to identify, assess, and mitigate critical risks from cybersecurity threats.

companyName: Vigil Neuroscience, Inc.


text: Our cybersecurity risk management program is informed by industry standards and includes, but is not limited to, ongoing monitoring for potential critical risks from cybersecurity threats using automated tools. We have a process designed to monitor and address identified cybersecurity risks. To support our cybersecurity risk management program, we leverage a managed security service provider (MSSP) and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response and vulnerability management and to perform periodic penetration testing, and other vulnerability analyses.


text: As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems or store our confidential data, including, as appropriate, through review of vendor questionnaires and the inclusion of cybersecurity requirements in contracts.


text: We also have an employee education and training program, offered during onboarding and on a periodic basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10K for more information.


text: Cybersecurity Program Oversight and Governance Our Head of Information Technology serves as our Information Security Officer (ISO) and has primary responsibility for managing our information technology team and external service providers and for generally assessing and managing our cybersecurity risk management program. Currently, the ISO role is held by an individual who has more than 20 years of experience in leading information security teams and who has implemented and managed cybersecurity programs for other publicly-traded biotechnology companies. Our ISO's experience includes developing and maintaining tools and processes designed to protect internal computer and telecommunications networks used to store, process, and transmit personal and confidential data.


text: Our ISO reports directly to, and meets periodically with, our Chief Financial Officer (CFO) to discuss and review our cybersecurity risk management processes, including our cybersecurity metrics, with input from the Company's MSSP and other third-party providers and cybersecurity consultants, as appropriate. Our ISO also works closely with our Chief Compliance Officer (CCO) in the establishment and management of controls and processes that underpin our cybersecurity risk management program and meets periodically with our entire executive management team, including our Chief Executive Officer, regarding cybersecurity threats and our cybersecurity risk management program. We have implemented a process for the ISO to report relevant findings from penetration testing and cybersecurity assessments conducted by third-party consultants to members of our management team, including our CFO and CCO, as appropriate.


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage or security breach, where applicable.


text: In connection with its oversight of our broader enterprise risk management program, our ISO, on a periodic basis, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. The chair of the audit committee and the ISO provide periodic reports on cybersecurity risk management to the full board of directors.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a security incident response plan.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a security incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors who have access to our critical systems and information; and • cybersecurity insurance to cover us for costs and expenses we may incur due to a cybersecurity incident.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, "Risk Factors— Risks Related to Our Operations—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO has over three decades of IT experience in life sciences organizations. Her cybersecurity work includes the development and implementation of cybersecurity policies, platforms, and robust end-user training curriculums. Our CIO and IT Information Security Group work together to monitor and r eport cybersecurity trends and threats to management. Additionally, we work with an external IT partner and external cybersecurity counsel to assess, identify, and manage risks from cybersecurity threats. The IT Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies, and plans on a periodic basis, and aims to review, and if appropriate update, applicable policies and procedures annually.


text: Our management team and IT Information Security Group takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Management's Role Managing Risk Aveanna's cybersecurity program and related policies are managed by a dedicated Assistant Vice President ("AVP") of Cybersecurity who reports to our Chief Information Officer ("CIO"). The AVP of Cybersecurity and his team is responsible for assessing, identifying and managing enterprise-wide cybersecurity needs. The AVP of Cybersecurity and his team monitor breach attempts and other cyber-related incidents, both directed at the Company and those impacting other industry participants, to identify new and emerging risks to be added to our Vulnerability Management Framework, which is discussed below.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: The AVP of Cybersecurity works directly with the CIO to create and maintain cyber policies, standards, and processes that support the Company's overall strategy and the current cyber environment. We believe our cybersecurity program and policies are aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The AVP of Cybersecurity and CIO are experienced technology and cybersecurity professionals, with over 10 and 20 years of experience in information security and technology, respectively. The AVP of Cybersecurity leads periodic meetings of our chartered Cybersecurity Steering Committee, which cover key cyber threats, policy changes, and project updates. The Cybersecurity Steering Committee includes our CIO, other executive-level leaders, and key members of management. Further, the Cybersecurity Steering Committee engages an external expert to prepare a formalized evaluation on the design of, and adherence to, the Company's current cybersecurity policies.


text: Board of Directors Oversight The Audit Committee of the Board of Directors is tasked with providing oversight related to cybersecurity topics. At least quarterly, the Audit Committee receives a report of any cybersecurity incidents and other key monitoring metrics from a representative of the Cybersecurity Steering Committee. For each incident, the Audit Committee is briefed on the nature of the incident, points of vulnerability, scope of the incident, and the Company's response. The Audit Committee will then communicate cyber-related issues with the Board as needed. Our Board monitors our existing cybersecurity program and related policies, including, among other things, the Board's role within our cybersecurity risk management infrastructure.


text: Risk Management and Strategy Our cybersecurity management process is based on an internally developed Intelligence Policy and a Vulnerability Management Framework. Cybersecurity risk management is currently independent of enterprise risk management. Our Vulnerability Management Framework addresses discovery, risk rating, remediation timeliness required per risk, and obligations on reoccurring third-party security products. Risks that fall outside the required remediation timeline are documented on the risk register, which is discussed during periodic Cybersecurity Steering Committee meetings.


text: We have in place a Security and Privacy Incident Response Plan that specifies incident classifications, reporting requirements, and which person must respond to such incidents. In most cases, cybersecurity management is handled by employees of the Company as described above, though if an incident does occur, external counsel and experts related to impacted systems or data may be engaged to supplement the Company's response.


text: Existing third-party relationships are monitored on a risk-by-risk basis via the Vulnerability Management Framework. Before entering into new third-party provider agreements, third-party providers and related services are subject to scrutinization and a review from the AVP of Cybersecurity's team.


text: We are constantly evolving our cybersecurity strategy and responses for new and emerging threats. As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats with respect to our information systems that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. For more information about the cybersecurity risks we face, see the risk factor entitled "Failure to maintain the security and functionality of our information systems, or to defend against or otherwise prevent a cybersecurity attack or breach, could adversely affect our business, financial position, results of operations and liquidity" described under "Risk Factors" contained in Item 1A of this Annual Report on Form 10-K.


text: We place a high priority on securing confidential business information and the personal information we receive and store about our customers and employees. Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, which we use, together with information collected from internal assessments, to develop policies for use of our information assets (for example, mobile phones and personal computers) and protection of personal information. We protect these information assets through techniques such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including restricting access to information based on business need. We utilize an established, nationally recognized cloud-services provider to maintain and manage our data with the exception of certain highly sensitive information, which we maintain in separate designated systems with enhanced security controls. In addition, we contract a third-party IT consultant with over twenty years of experience, who manages the core information technology functions of the business including coordinating with our cloud-services provider, implementing new processes, monitoring of our network for cyber threats, and other information technology administrative responsibilities. Throughout the year, we train our employees on cybersecurity awareness, confidential information protection and perform simulated phishing attacks. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have developed a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure and comply with applicable legal obligations. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. To date, we have not experienced a material cybersecurity or information security breach.

companyName: Heritage Global Inc.

ticker: HGBL


text: Oversight responsibility in this area is shared by management, the Board, and its Corporate Governance Committee. To prevent, detect and respond to information security threats more effectively, the Company has established a Management Cybersecurity Committee (MCC) consisting of the Chief Financial Officer, the Executive Vice President, General Counsel and Secretary, the Chief Marketing Officer, business unit leaders, the third-party IT consultant, and other internal and external IT resources. The MCC regularly reports to the Corporate Governance Committee, which in turn reports to the Audit Committee and the Board. The Board also receives an annual update from our senior leadership on cybersecurity and information security matters. The Corporate Governance Committee regularly briefs the Board on these matters, and the Board also receives periodic briefings on cyber threats to enhance our directors' awareness on cybersecurity and information security issues.


text: At its core, our cybersecurity program is the collection of people, processes and technologies that are designed to protect our networks, computers and data from attack, damage, or unauthorized access. The cybersecurity program is also part of a broader cybersecurity framework, which involves how we assess and manage cybersecurity threat risks and how this integrates into our overall risk management framework. While the foregoing summary is specific to our North America business operations we believe that the cybersecurity programs of our International business operations are consistent with the approach and framework outlined below and are appropriate for the scope and scale of their operations.


text: The Security and Compliance Team, within our IT department, takes the lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. The Security and Compliance Team is led by the Security and Compliance Program Manager and consists of a Lead Security Engineer and a Security Analyst. The Security and Compliance Team works very closely with our team across the IT department and with several different third parties who provide expertise in different areas such as threat hunting and penetration testing.


text: Objectives and Key Principles and Priorities The objective of the Security and Compliance Team is to build practices within the company to define, implement, enforce, and measure our security, compliance and disaster recovery readiness. In doing so, it utilizes some of the following key guiding principles and priorities: • Alignment. Working within the organization to clearly define the need for secure computing practices, gaining buy-in on this need and the development of a mindset across the organization around secure computing. • Measurement and Visibility. Developing measurement and reporting methods which inform our stakeholders both in the business as well as external audit and other outside entities as to compliance with various security frameworks and regulatory obligations. • Protection. Using a commonly accepted industry framework to build and ensure the enforcement of policies and procedures which secure the data and systems of all our stakeholders. • Response. Ensuring that that if a security incident occurs there is a clear and well understood response plan which is followed by all response participants. • Resources and Tools. Identifying the resources needed to run the cybersecurity program commensurate with the size and complexity of our company, including identifying and implementing appropriate tools and systems to help strengthen our security posture.


text: On a day-to-day basis and from a project perspective, the Security and Compliance Team undertakes the following activities: • Builds and reviews reports on newly identified security threats. • Monitors various internal security toolsets including EDR (Endpoint Detection and Response), email security and logging from company firewalls and other security related systems and takes action to prevent or resolve incidents identified by monitoring. • Ensures that appropriate vendor patches/configurations are applied to the various internal systems that operate to maintain a secure environment. • Works with various teams with the IT department to ensure that company servers and data are properly backed up and that compliance requirements and security best practices are following during new system implementations. • Deploys and tunes various security and monitoring platforms. • Manages the North America Annual PCI (Payment Card Industry) review and consults with Zumiez international entities regarding PCI. • Provides evidence gathering for, and conducts walk throughs with, internal and external audit teams for internal control over financial reporting related to Section 404 of the Sarbanes-Oxley Act of 2002 (SOX Controls). • Maintains a system of security policies and procedures within the IT department related to cybersecurity and compliance requirements, primarily related to PCI compliance and SOX Controls.


text: Framework for Cybersecurity Controls We have implemented risk-based controls to protect our networks, computers and data. To this end, we utilize the Center for Internet Security (CIS) version 8.0 framework, which is comprised of eighteen critical security controls. The CIS framework is based on the COSO (Committee of Sponsoring Organizations on the Treadway Commission) and NIST (National Institute of Standards and Technology) frameworks and provides a highly actionable way to implement those frameworks and maps directly to other compliance requirements relevant to us, including PCI compliance and SOX controls (briefly discussed above).


text: Use of Third Parties We work with a third party that provides us with threat hunting services via an Endpoint Detection and Response (EDR) platform. This team proactively searches for newly uncovered threats based on up-to-the-minute intelligence on the cybersecurity threat landscape and their knowledge of the Zumiez environment. Upon discovery of a potential threat, the threat hunting team provides initial remediation guidance.


text: We also conduct periodic penetration testing of our systems. This testing is performed by a qualified third-party testing company and is in alignment with our CIS controls. Penetration testing is meant to provide us with information on the security of a particular system or application. These findings then can be used by us to inform remediation work on a go-forward basis. Cybersecurity Insurance.


text: We maintain what we believe are appropriate levels of cybersecurity insurance that covers settlements, judgments and defense costs arising out of a failure of network security, a privacy breach, media liability, business income loss resulting from a cyber event and for cyber extortion coverage. This cybersecurity insurance coverage also provides for the following breach response services in connection with incidents involving the theft, loss or unauthorized disclosure of third-party information and computer system security breaches: • Computer expert services (such as a cybersecurity firm to determine the existence and cause of an actual or suspected electronic data breach or a PCI forensic investigator in connection with investigations dealing with credit card data); • Legal services; • Notification services to provide notification to impacted individuals; • Call center services; • Breach resolution and mitigation services, including credit monitoring and identity theft monitoring; and • Public Relations and crisis management expenses.


text: Cybersecurity Incident Response Plan We have a Cybersecurity Incident Response Plan which is maintained by the Security and Compliance Team. The Incident Response Plan establishes what people and organizations need to be engaged in the event of a significant incident. The Incident Response Plan also provides templates for technical resolution, documentation and communication to internal stakeholders as well as insurers and governmental and other regulatory agencies.


text: We also manage cybersecurity risk by limiting our threat landscape. For example, as an omni-channel retailer, we accept credit and debit cards via all sales channels and protecting cardholder data is a critical component of our security practices. Accordingly, PCI compliance (discussed briefly above) is very important and we engage an external qualified assessor to audit our compliance and to provide us with a report on compliance that is also shared with various payment providers. To help reduce our exposure to unauthorized access of cardholder data, we have utilized a strategy of minimizing or eliminating the storage of, and unencrypted transmission of, cardholder information across our various systems.


text: Moreover, our businesses do not involve or represent national infrastructure, the likes of which are common targets of cyber attackers (e.g., energy, oil & gas, transportation, communications, banking and financial systems, etc.). We recognize that cyber threats are a permanent part of the risk landscape and that new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority at Zumiez.


text: Like many companies, we face a number of cybersecurity risks in the day-to-day operation of our business. Although to date these risks have not materialized into any instances or series of instances that have had a material adverse effect on our business or otherwise caused material harm to the company, we have, on occasion, experienced cybersecurity threats to our data and information systems, including phishing attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "If we fail to meet the requirements to adequately maintain the privacy and security of personal data and business information, we may be subject to adverse publicity, litigation and significant expenses" in Item 1A Risk Factors.


text: As discussed above, the Security and Compliance team takes a lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. This team is supported by our Zumiez North America Cybersecurity Team, which consists of the Security and Compliance Program Manager, the Director of Infrastructure IT, the Vice President of IT, the Chief Financial Officer and the Chief Legal Officer. Additional support and guidance are provided by the Zumiez North America IT Steering Committee, which consists of the Chief Financial Officer, Chief Legal Officer, the Executive Vice President of North American Consumer Teams, the Vice President of IT, the Director of Infrastructure IT and the Senior Program Manager of Digital Commerce. Together, the Zumiez North America Cybersecurity Team and the Zumiez North America IT Steering Committee provide guidance and oversight to the Security and Compliance Team in alignment with the company's overall risk management and oversight framework.


text: Members of management, including our Chief Legal Officer, regularly report on the company's cybersecurity matters to our board's Audit Committee. The Audit Committee has been assigned the responsibility for reviewing and discussing with management the company's major operational, legal and regulatory risks, including data security and privacy and the company's policies to identify and manage cybersecurity risks.


text: Quarterly Cybersecurity Memos. At the 2nd, 3rd and 4thquarter Audit Committee meetings, an update memo is provided to the Audit Committee that details the progress against the Annual Cybersecurity Plan, any updates on PCI compliance and SOX compliance activities and any emerging threats. The memo also contains a summary of significant cybersecurity threats over the past quarter both within our ecosystem and outside our ecosystem and any impact (if any) they may have had upon the company.


text: Internal Audit Reports. Our internal audit function's reviews of our information security programs and controls are included in quarterly reports to the Audit Committee.


text: The cybersecurity program and related risks are also discussed with the full Board of Directors as part of the review and discussions around the topic of risk management and the risk oversight framework that generally take place at the 3rd quarter Board of Directors meeting.


text: Any potentially significant information security issues that arise during the year are discussed with management and captured in our disclosure controls and procedures and are discussed with our Audit Committee chair between board meetings as appropriate.


text: Risk Management and Strategy Identifying, assessing, and managing material cybersecurity risks is an important function of our enterprise risk management program. Material cybersecurity risks from cybersecurity threats are managed across Medallion Financial Corp., the Bank, Medallion Capital, and third-party vendors and monitoring such risks and threats involves coordination between us as the parent company and our two main operating subsidiaries. We continue to integrate our cybersecurity programs into our enterprise risk management program, which is led by various senior representatives of the Company and overseen by the Audit Committee of the Company's Board of Directors.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: Medallion Financial Corp., the Bank and Medallion Capital are each responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These programs have been guided by the National Institute of Standards and Technology Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable, and seek to protect each entity against cybersecurity risks and provide a foundation to respond promptly to cybersecurity events. Each entity maintains technical and organizational safeguards, including, among other things, employee testing and training, incident response programs and tabletop exercises, evaluations and assessments by third parties, vulnerability scanning, vendor management, cybersecurity insurance, and business continuity mechanisms for the protection of Company assets. Our programs also assess and manage third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third-party service providers.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, and we currently do not expect that risks from cybersecurity threats are reasonably likely to materially affect us, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: The Audit Committee of our Board of Directors is responsible for overseeing the Company's enterprise risk management program, including overseeing the adequacy of protection of the Company's technology, including physical security, patent and trademark program, proprietary information, and information security. The Audit Committee receives quarterly reports from our Information Security Director and third parties on cybersecurity matters. In addition, the Audit Committee receives quarterly reports addressing cybersecurity as part of our enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. These reports include, among other things, existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents, if any, and the status of key information security initiatives. Our Audit Committee members also engage in ad hoc conversations with management on cybersecurity-related news and events, and discuss any updates, as needed, to our cybersecurity risk management and strategy programs.


text: Medallion Financial Corp. employs a Director of Information Security, and our main operating subsidiaries have similar functions and/or roles conducted by various individuals. Such information security leadership are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These individuals' expertise in information security and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams and third-party vendors about, and monitor, the prevention, detection, mitigation and remediation efforts relating to any cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated from information security leadership through a variety of different channels, including discussions between or among subsidiary and parent company management, reports to subsidiary and parent company risk committees and reports to subsidiary and parent company boards and board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from our Information Security Director and third parties as well as part of our enterprise risk management program.


text: Cybersecurity Risk Management and Strategy To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices.

companyName: AWARE INC /MA/

ticker: AWRE


text: The Company has implemented a Cybersecurity Policy (the "Policy") that provides a framework for responding to cybersecurity incidents. The Policy includes requirements for incident disclosure and reporting, protocols for incident evaluation, including the use of third-party service providers and partners, and processes for notification and internal escalation of information to the Company's senior management, incident response team, and Board of Directors (the "Board") and appropriate Board committees. The Policy also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary but no less frequently than once a year, under the leadership of the Company's Chief Security Officer ("CSO").


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.

stage1Category: None/Other


text: The Board of Directors, primarily through its Audit Committee, oversees the Company's cybersecurity program. Management regularly reports to the Audit Committee on the current state of the Company's cybersecurity program, including the current threat landscape, cybersecurity risks, and any significant incidents. The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.


text: At the management level, the Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported, to the extent required by applicable law.