text: Cybersecurity Threat Disclosure We are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business, results of operations, or financial condition. In the event of a future cybersecurity incident, the Company has procedures in place to identify whether the incident or associated cybersecurity risks have materially affected or are reasonably likely to materially affect the Company, to ensure that disclosures are made where required under applicable law or regulation. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Senior Technology/Cybersecurity Officer is primarily responsible for this cybersecurity component and is a key member of the Company's Information Technology Governance, along with our Chief Finance/Information Security Officer, including the Enterprise Risk Management Committee ("ERM"), the Information Technology Steering Committee ("ITSC") and the Information Technology Advisory Committee ("ITAC"), reporting directly to the Chief Information Officer. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 30 years of cybersecurity experience, 5 of which was spent at the Company. The ITAC and ERM are board level committees with the ITSC consisting of members of management.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA

secItem: Item 1C


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Finance/Information Security Officer and our Chief Information Officer, report directly to our Chief Executive Officer, and along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "secure by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a portion of our workforce has the option to work remotely. We leverage internal auditors to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below. The IRP is coordinated through the Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and key members of management are embedded into the IRP by its design. The IRP facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company.


text: Our Chief Finance/Information Security Officer has oversight of information security across the organization, with the Senior Technology/Cybersecurity Officer independently accountable for managing our enterprise information security department and delivering our information security program. The responsibility of this role includes cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first and second line of defense functions. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Information Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the ITAC, which focuses on technology impact, and ERM, which focuses on business impact while the ITSC is an internal management committee providing direction and priorities to information technology strategies. These committees provide oversight and governance of the technology program and the information security program. The ITAC and ERM are chaired by certain members of the board of directors with senior management participation including the Chief Finance/Information Security Officer, Chief Information Officer, Senior Technology/Cybersecurity Officer as well as other key departmental managers from throughout the organization. These committees meet periodically to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Senior Technology/Cybersecurity Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the ITAC on a quarterly basis (or more frequently as may be required by the IRP).


text: The ITAC is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and our Chief Information Officer provide quarterly reports to the ITAC and ERM regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The ITAC reviews and approves our information security and technology budgets and strategies annually. Additionally, the ERM reviews our cyber security risk profile on a quarterly basis. The ITAC and ERM provide a report of their activities to the board of directors regularly.


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. The Company takes very seriously the responsibilities to protect sensitive client information, technology resources, and shareholder value from the risk of cyber threats and incidents. The Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition or results of operation. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Cybersecurity Risk Management and Strategy The Company maintains an enterprise-wide and Board-approved Information Security Program (the "Program"), which includes policies, procedures, guidelines and standards to address the assessment, identification and management of cybersecurity risks. The Company designed the Program to be consistent with industry standards that include National Institute of Standards and Technology ("NIST") Cybersecurity Framework, the Financial Services Sector Cybersecurity Risk ("CRI") Profile, and the Federal Financial Institutions Examination Council Cyber Security Assessment. Core activities supporting the Company's strategy include leveraging people, technology and processes to manage and maintain cybersecurity controls.


text: People play a significant role in our defense against cybersecurity threats. We have established policies, training, and client education to mitigate cyber risk.


text: Additionally, we employ innovative technology solutions designed to identify, protect, detect, and mitigate cybersecurity threats through use of firewalls, intrusion detection systems, patching, endpoint detection and response, encryption, multi factor authentication, and data backups to immutable storage.


text: We regularly engage third-party assessors, auditors, and solutions to test and evaluate our controls for managing cybersecurity threats. These engagements include penetration testing, vulnerability assessments, internal and external audits, security framework maturity assessments for continued focus and improvement, and social engineering tests of the effectiveness of our employee training to monitor our security posture. We leverage a managed service provider to monitor users, application, infrastructure, and network activity on a 24/7/365 basis to detect and alert the cyber security operation team of cyber threats and potential cybersecurity events of concern.


text: The Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. We exercise a detailed vendor due diligence evaluation during the onboarding, and periodic reviews of these vendors with access to sensitive Company data. The Company requires contracts of third parties to incorporate industry and regulatory standard clauses requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.


text: In the event of a cyber incident, the Company created and maintains a Business Contingency Program. This program provides guidance that will be needed to prepare, detect, analyze, remediate and recover business operations quickly and with the least impact to the Company and its customers.


text: Cybersecurity Governance The Company has established an Information Security Committee consisting of the Chief Operations & Technology Officer, Chief Risk Officer, Information Security Officer and department representatives across multiple functional areas of the Company to focus on cybersecurity strategic and tactical delivery, policy oversight, monitoring of key cybersecurity risk indicators, and the assessment and management of cyber risk threats. The Committee is assisted by a Virtual Chief Information Security Officer (the "vCISO") which is provided by a contracted third-party security firm. The Committee's activities support the overall protection of data and information assets of the Company in accordance with the Information Security Program, regulatory privacy requirements and Federal Financial Institutions Examination Council guidance. The Committee submits a quarterly report, together with the minutes of its meetings, to the Enterprise Risk Management Committee of the Board of Directors.


text: The Chief Operations & Technology Officer, among other duties, is responsible for the security and integrity of infrastructure, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the vCISO and our risk management department. Our Chief Operations & Technology Officer has over 25 years of relevant experience in information technology and information security, building and leading technical organizations of various sizes, including in the banking industry. The vCISO has served in various roles in information technology and information security for 20 years, and holds multiple certifications relevant to cybersecurity, including CMMC (Cybersecurity Maturity Model Certification) and Fortinet NSE (Network Security Expert) level 3.


text: The Board of Directors receives periodic training related to cybersecurity and annually reviews comprehensive risk assessments of the Company's information technology, privacy and cybersecurity programs. The Board of Directors formally approves the Company's cybersecurity policies and program annually, and more frequently if material changes are adopted. Oversight of the Company's Information Security Program has been delegated to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee receives quarterly reports on the effectiveness and overall performance of the cybersecurity program and provides a report of the same to the full Board of Directors.


text: The Company engages external independent parties to perform independent audit engagements, as well as other assessments of the Company's information security and third-party risk management program and information systems. Material findings and recommendations arising from these assessments are reported to the Audit Committee of the Board of Directors.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the Investment Company Act, our day-to-day operations are managed by the Investment Adviser, Administrator and our executive officers under the oversight of our Board of Directors. Our executive officers are senior professionals of the Investment Adviser. We obtain our cybersecurity program-related services as part of a larger set of services provided to the parent company of our Investment Adviser by JFG under written agreement. As such, we rely on JFG's information systems infrastructure and JFG's processes for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details JFG has provided to us regarding its cybersecurity program.

companyName: Senior Credit Investments, LLC


text: JFG's Chief Information Security Officer ("CISO") and his Global Information Security team ("GIS") oversee JFG's cybersecurity program and exercise overall responsibility for the strategic vision and the design, development, and implementation of, and adherence to, the program's protocols. The comprehensive program includes policies and procedures designed to protect JFG systems, operations, and the data entrusted to it, including by us, from anticipated threats or hazards. The program applies seven layers of controls: governance, identification, protection, detection, response, recovery, and third-party vendor management. Protective measures include, where appropriate, physical and digital access controls, software security and patch management, identity verification, mobile device management, data loss prevention solutions, employee cybersecurity awareness communications and best practices training programs, security baselines and tools to detect and report anomalous activity, service provider risk assessments, network monitoring of data usage, hardware and software, and data erasure and media disposal, among others. Measures, policies and standards are aligned with industry-leading frameworks, such as those promulgated by the International Organization for Standardization and the National Institute of Standards and Technology ("NIST").


text: JFG tests its cybersecurity defenses regularly through automated vulnerability scanning by GIS's 24/7 Security Operations Group to identify and remediate critical vulnerabilities. In addition, an independent vendor conducts annual "white hat" penetration tests to validate its external security posture. For certain JFG businesses, JFG also conducts cyber incident tabletop exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by JFG's IT Risk team in collaboration with outside service providers as appropriate and members of JFG's senior management and Legal and Compliance teams. Learnings from these tabletop exercises and any events that JFG experiences are reviewed, discussed, and incorporated into its cybersecurity risk management processes as appropriate. In addition to JFG's internal exercises to test aspects of its cybersecurity program, JFG annually engages an independent third party to assess the risks associated with its information systems and information assets and the JFG risk management program. The independent third party assesses the cybersecurity program against the Cyber Risk Institute Cyber Profile, a financial sector-focused framework based on the NIST Cybersecurity Framework, the results of which are reported to the JFG Board of Directors (the "JFG Board") and inform JFG's program.


text: JFG has a comprehensive cybersecurity incident response and communication plan (the "IRP"), managed by the Security Operations Group, which is designed to inform appropriate risk management and business managers (including, as appropriate, our executive officers and other representatives of the Investment Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate such an event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and law enforcement agencies. The IRP is reviewed at least annually.


text: JFG maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. This process includes reviewing risks discerned from time to time from both internal events and from external events, alerts and reports received from a broad variety of sources. Reports from external sources are also reviewed to formulate risk mitigation and remediation strategies. JFG's CISO periodically discusses and reviews cybersecurity risks and related mitigants with JFG's Chief Information Officer ("CIO"), the Head of IT Risk, and General Counsel and incorporates relevant cybersecurity risk updates and metrics. JFG adjusts and enhances its cybersecurity program in response to the evolving cybersecurity landscape and to align with regulatory and industry standards.


text: JFG employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors and service providers. This assessment is conducted on the basis of, among other factors, the types of products or services provided and the extent and type of data accessed or processed by the third party.


text: Cybersecurity is assessed by IT Risk and approved by the CIO as a component of JFG's annual, enterprise-wide Risk Control Self Assessment ("RCSA") managed by JFG's Operational Risk Group. The RCSA process is independently verified by JFG's Internal Audit Department.


text: Although since inception, we have not experienced a material information security breach incident, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the JFG and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors - Risk Related to our Business - Cybersecurity risks and cyber incidents may adversely affect our business or the business of our Portfolio Companies by causing a disruption to our operations or the operations of our Portfolio Companies, a compromise or corruption of our confidential information or the confidential information of our Portfolio Companies and/or damage to our business relationships or the business relationships of our Portfolio Companies, all of which could negatively impact the business, financial condition and operating results of us or our Portfolio Companies" in this annual report.


text: Cybersecurity Governance JFG has a dedicated GIS team, led by its CISO, who reports to JFG's CIO. The CISO works closely with JFG's CIO, Chief Financial Officer, and the Chief Risk Officer's ("CRO") team and Legal and Compliance Departments, to develop and advance the firm's cybersecurity strategy, which applies to us.


text: JFG's CISO has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across JFG's global businesses. He has over twenty years' experience managing cybersecurity in the financial and consulting services industries.


text: JFG conducts periodic cybersecurity risk assessments, including assessments of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CISO reviews the cybersecurity framework annually as well as on an event-driven basis as necessary, and reviews the scope of cybersecurity measures periodically, including to accommodate changes in business practices that may implicate security-related issues.


text: JFG's cybersecurity program is periodically assessed by JFG's Internal Audit Department. The results of these audits are reported to the Audit Committee of the JFG Board. Any resulting findings and associated actions to address issues are tracked and managed to completion. In addition, JFG's IT Risk team provides Key Risk Indicators ("KRIs") monthly to JFG's Operational Risk Committee whose members include the CIO, CRO, Head of Internal Audit and the CISO and their representatives. The monthly presentation includes updates on key security incidents and trending of cybersecurity KRIs.


text: The JFG Board is responsible for the general oversight of all matters that affect JFG, including the myriad risks impacting it. The JFG Board fulfills its oversight role through the operations of its various committees and receives periodic reports on its committees' activities.


text: The JFG Board's Risk and Liquidity Oversight Committee oversees JFG's enterprise risk management. Oversight includes reviewing and approving annually JFG's risk management framework and overarching risk appetite statements; reviewing JFG's technology, cybersecurity and privacy risk, legal and regulatory risk, and reputational risk,among other JFG major risk exposures; reviewing the steps management has taken to monitor and control such exposures; and reviewing JFG's capital, liquidity and funding against established risk methodologies. The CISO keeps the JFG Board informed about JFG's security posture and cybersecurity maturity program on a regular basis, providing updates about cybersecurity events, significant incidents, and new initiatives.


text: Our Board of Directors is responsible for understanding the primary risks to our business, including any cybersecurity risks. Our Board of Directors may receive periodic updates from our Chief Compliance Officer, our General Counsel, our Chief Operating Officer or from our Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting our business.


companyName: Jefferies Credit Partners BDC Inc.


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.


text: The Information Technology ("IT") Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (the "CIO") who reports directly to the Company's Chief Operating Officer and Chief Financial Officer. The CIO has more than 37 years of relevant experience both with the Company and with other organizations in the IT field. The CIO also oversees the Company's Information Security Program and manages a third-party consultant that is an expert in the Information Security field and acts as our Information Security Officer ("ISO"). The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The IT Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology and Information Security Committee ("IT/IS Committee"), and presents information security and cybersecurity updates on a monthly basis to the IT/IS Committee and periodically to the Board of Directors.


text: The IT/IS Committee provides oversight, from a risk perspective, of information systems security. As referenced above, the CIO and ISO provide information security updates to the IT/IS Committee at each IT/IS Committee meeting. Additional information security training for the committee is provided through targeted training overseen by the ISO. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Board of Directors. At least annually, the ISO coordinates tabletop testing events where senior management participate in a coordinated response exercise to disastrous scenarios that could happen to the Company. Cybersecurity metrics are reported to the IT/IS Committee on a monthly basis.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with the IT/IS Committee, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT/IS Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: Service Providers. Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Third-Party Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and customer information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to monthly simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the CIO and ISO report to the Board, directly, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CIO and ISO monitor, evaluate, and adjust the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CIO and ISO are responsible for implementing and maintaining the IRP, which includes: a) Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents.


text: b) Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.


text: c) Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. d) Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.


text: e) Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: The Company depends on the confidentiality, integrity and availability of information systems and data. We have systems and processes in place to assess, identify and manage cybersecurity incidents and those systems and processes are integrated into our overall risk management system.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: Internal and third-party risks are reviewed, monitored and managed by the Company's IT ISC2, SANS, CompTIA certified security partners and external expert consultants. The Company annually engages third-party experts to assess the effectiveness of system and network security. Periodically, an external independent consultancy team conducts a comprehensive review of the Company's cybersecurity program using the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Additionally, the Company is assessed annually by an independent third party for compliance with the PCI-DSS standard, for which the Company receives an attestation of compliance.


text: The Company's security awareness program seeks to create a culture of shared responsibility for the security of sensitive data and systems. There is required annual security training and quarterly phishing campaigns for team members with access to Company email. Annually, members of the IT department are required to take IT specific training, and store employees take operations and security training. A third-party led social engineering campaign that targets Kirkland's employees is carried out on an annual basis. Key performance indicators and periodic testing of training materials ensure the program's effectiveness.


text: The Company's process for identifying and managing first and third-party risks from cybersecurity threats includes proactive threat hunting, continuous monitoring of the Company's systems and network for cybersecurity events, and regular testing of the Company's Security Incident Response Plan, Business Continuity Plan, and Disaster Recovery Plan. An external managed security services provider and an industry-leading security tool continuously monitors, detects, and responds to the Company's systems and network for cybersecurity threats. The Company's IT security partners evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. A third-party with extensive experience in incident response and forensics is on retainer to assist with incidents. The Incident Response Plan includes reporting and escalation procedures to inform the Company's executives, the Audit Committee, and full Board of Directors, as appropriate, to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Incident Response Plan and Disaster Recovery Plan include procedures for business recovery and are tested at least annually. The Company also maintains a cyber insurance policy that provides coverage for material IT security incidents.


text: No risks from cybersecurity threats have materially affected, nor has the Company identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Please see "Item 1A. Risk Factors — Risks Related to Technology and Data Security" for additional discussion of cybersecurity risks applicable to the Company.


text: Management Responsibilities Our cybersecurity program is managed by our Chief Technology Officer ("CTO"). Our CTO has 10 years of experience in information technology and cybersecurity, having been at the Company since 2023. The CTO, along with the Company's IT security partners, is responsible for reducing cybersecurity risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events, responding quickly and building procedures to rapidly recover, if needed.


text: Board Responsibilities On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee quarterly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities and compliance with cybersecurity and privacy laws and regulations. The Company's Chief Technology Officer briefs the Audit Committee quarterly on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. We have designed and implemented an Incident Response Plan for cybersecurity and related processes that are overseen by our IT and management team. Our information security management system is ISO 27001 certified. In addition, our cybersecurity program leverages industry frameworks, including certain of those established by the National Institute of Standards and Technology (NIST).

companyName: AMBARELLA INC

ticker: AMBA


text: We regularly assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect our information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing procedures, systems, and safeguards in place to manage such risks. Our cybersecurity risk management program is integrated into our overall risk management scheme by seeking to identify and mitigate those cybersecurity threats that are more likely to lead to a material impact on our business.


text: Our cybersecurity risk management program also seeks to manage cybersecurity risks associated with our use of third-party service providers through risk assessments and contractual obligations on such service providers.


text: Our IT management team, with oversight from our Board of Directors and Nominating and Corporate Governance Committee as well as members of our management team, including our Chief Operating Officer, Chief Financial Officer and General Counsel, are primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: We also engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Nominating and Corporate Governance Committee oversight of cybersecurity matters and other policies and internal controls regarding information security risks. The Nominating and Corporate Governance Committee oversees management's implementation of our cybersecurity risk management program.


text: The Board of Directors and the Nominating and Corporate Governance Committee receive presentations and reports on cybersecurity, which address a range of topics including recent developments, evolving standards, the threat environment, cybersecurity systems testing and vulnerability assessments, and the Company's practices and policies to manage risks. Management reports to the Nominating and Corporate Governance Committee on cybersecurity matters and materials risks, if any, from cybersecurity threats. Our Nominating and Corporate Governance Committee provides updates to the Board of Directors on such reports. The Nominating and Corporate Governance Committee also receives notice of any significant cybersecurity incidents, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our management team, including our IT management team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Operating Officer, Chief Financial Officer and General Counsel. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Senior Director of IT has served in various roles in information technology and information security for over 25 years.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief Operating Officer, Chief Financial Officer and General Counsel. This team of business leaders works with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified.


text: As part of our overall risk management system, we provide periodic mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with information and tools to address cybersecurity threats, and to communicate our information security policies, processes and practices. We also perform periodic email phishing tests to evaluate and maintain cybersecurity awareness among our employees.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition. As cybersecurity threats become more sophisticated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures. For additional information concerning risks related to cybersecurity, see Item 1A of this report, "Risk Factors – Risks Related to Our Business and Our Industry – A breach of our security systems may have a material adverse effect on our business."


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our customers and other stakeholders, as a top priority. Our board of directors (in particular our audit committee) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: Strategic Storage Trust VI, Inc.

ticker: SGST


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and updates are presented to our board of directors and members of management, as appropriate.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and other developing cybersecurity practices.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our response to—a cybersecurity incident.


text: Third-Party Risk Management We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: PyraMax Bank recognizes the critical importance of cybersecurity in maintaining the integrity, confidentiality, and availability of its systems and data. As a financial institution entrusted with sensitive customer information and financial assets, PyraMax Bank is committed to implementing robust cybersecurity risk management practices, strategies, and governance mechanisms.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: Our Information Security Officer is primarily responsible for this cybersecurity component and reports directly to the EVP-Chief Operations Officer. The Board of Directors has approved an Information Technology Steering Committee, which focuses on technology and business impact. The committee provides oversight and governance of the technology and information security programs. The committee is chaired by the ISO and compiled of managers throughout the entire company. The committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken in the IT Steering Committee to our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: Cybersecurity Risk Management: PyraMax Bank employs a comprehensive approach to cybersecurity risk management to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.


text: 1. Risk Assessment: Regular assessments of cybersecurity risks are conducted annually to identify potential threats, vulnerabilities, and their potential impact on the Bank's operations. These assessments encompass both internal and external factors affecting PyraMax's IT infrastructure and systems.


text: 2. Risk Mitigation: Upon identifying risks, PyraMax Bank's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. This involves deploying advanced security technologies, implementing security best practices, and ensuring compliance with industry standards and regulations.


text: 3. Monitoring and Response: PyraMax Bank maintains continuous monitoring capabilities to detect and respond to cybersecurity incidents promptly. Automated tools, as well as internal and external dedicated security teams, are utilized to monitor network traffic, system logs, and other relevant indicators of compromise.


text: 4. Audit and Testing: Independent third-party penetration testing, IT Control Audits, and vulnerability assessments are completed at least annually to test the effectiveness of security controls and preparedness measures (or more often if warranted by the risk assessment or other external factors). The Information Security Officer determines the scope and objectives of the penetration analysis. Results of audit and testing are reported to the IT Steering Committee for management and the board of directors for oversight.


text: Cybersecurity Strategy: PyraMax Bank's cybersecurity strategy is aligned with its overall business objectives and risk appetite. Key components of the Bank's cybersecurity strategy include:


text: 1. Defense-in-Depth: PyraMax Bank employs a multi-layered approach to cybersecurity, incorporating multiple defensive measures at various levels of its IT infrastructure. This includes firewalls, intrusion detection systems, endpoint protection, and data encryption.


text: 2. Employee Awareness and Training: PyraMax Bank recognizes that employees are a critical line of defense against cyber threats. Therefore, the Bank invests in comprehensive cybersecurity awareness training programs to educate employees about potential risks and best practices for safeguarding sensitive information.


text: 3. Vendor Risk Management: PyraMax Bank evaluates and manages the cybersecurity risks associated with third-party vendors. Vendor contracts include provisions for security requirements, regular assessments, and compliance with industry standards.


text: 4. Incident Response Plan: PyraMax Bank maintains an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan if tested, reviewed, and approved by the IT Steering Committee annually and reported to the board of directors.


text: Cybersecurity Governance: PyraMax Bank maintains a cybersecurity governance framework to ensure effective oversight and accountability. Key elements of the Bank's cybersecurity governance structure include:


text: 1. Board Oversight: The Board of Directors provides oversight of PyraMax Bank's cybersecurity posture, including reviewing and approving cybersecurity policies, strategies, testing, and investments.


text: 2. Executive Leadership Involvement: Senior management actively participate in setting cybersecurity objectives, allocating resources, and monitoring performance against established goals through the IT Steering Committee.


text: 3. Risk Committees: PyraMax Bank has established an IT Steering Committee responsible for overseeing cybersecurity risks and ensuring alignment with the Bank's overall risk management framework.


text: PyraMax Bank remains committed to maintaining the highest standards of cybersecurity to protect the interests of its customers, shareholders, and other stakeholders. By implementing robust risk management practices, strategic initiatives, and effective governance mechanisms, PyraMax Bank strives to mitigate cybersecurity risks and safeguard its operations against evolving threats.


text: Cybersecurity Risk Management and Strategy In recognition of the evolving cybersecurity threat landscape, we acknowledge the increasing sophistication and frequency of cybersecurity incidents. While we cannot completely protect against the possibility of a cybersecurity incident occurring, we take measures designed to mitigate risks from cybersecurity threats, including those implemented by our third-party managed services provider.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: As part of our cybersecurity procedures, we leverage a number of security controls, including network and device monitoring and system backup procedures. We work to mitigate risks from cybersecurity threats stemming from third-party vendors by providing them with access only to systems that they need to provide services to us.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see "Item 1A, Risk Factors."


text: Cybersecurity Governance Senior management, including the Chief Executive Officer and Chief Financial Officer, are responsible for implementation of the Company's risk management controls, including controls in connection with risks from cybersecurity threats.


text: The Audit Committee of our Board of Directors is primarily responsible for overseeing the Company's compliance and risk management obligations, including the management of risks from cybersecurity threats. Pursuant to its charter, the Audit Committee is responsible for monitoring the effectiveness of the Company's information system and cybersecurity controls.


text: On a quarterly basis, the Audit Committee discusses with senior management, and internal audit, if applicable, the Company's processes for assessing, identifying, and managing material risks from cybersecurity threats and the state of the Company's cybersecurity processes. The Audit Committee also receives updates on, and monitors, the Company's prevention, detection, mitigation and remediation of cybersecurity incidents.


text: At Urgently, we understand the paramount importance of cybersecurity in safeguarding our operational integrity, customer information, and proprietary data. Our commitment to cybersecurity excellence involves a comprehensive approach to risk management and the continual enhancement of our cybersecurity protocols to address the dynamic nature of cyber threats.

companyName: Urgent.ly Inc.

ticker: ULY


text: Board Oversight and Cybersecurity Governance Our cybersecurity strategy is anchored in a governance structure with board-level oversight. The Board of Directors plays a critical role in guiding our corporate governance, our cybersecurity posture, ensuring that cybersecurity risks are adequately evaluated and managed in alignment with our business objectives. To this end, the Board will receive periodic updates on our cybersecurity initiatives, risk management practices, and incident response measures. This oversight ensures that cybersecurity remains a top priority at the executive level and that strategic decisions reflect our commitment to safeguarding our digital assets.


text: The Board is supported by and will receive reports from the Cybersecurity Risk Committee, a specialized group that includes senior executives and departmental representatives from information technology, legal, human resources, and operations. This committee is charged with the development of cybersecurity policies, evaluation of defense mechanisms, and oversight of the company's response to cyber incidents.


text: Our Cybersecurity Risk Committee is led by our CISO and our Director of Cyber Security and Compliance. These two individuals have decades of experience in designing, implementing, and managing cyber security risk programs. They are experts in the assessment, identification, and management of cybersecurity risk. Our Cybersecurity Risk Committee members receive updates about our security from our information technology and security teams, stay abreast of industry trends and regulations, and regularly inform management of various cybersecurity risks, trends, threats, and countermeasure techniques.


text: Cybersecurity Risk Management Program Our Cybersecurity Risk Management Program is informed by the Center for Internet Security (CIS) Controls version 18. The CIS Controls offer a strategic framework that directs our implementation of effective cybersecurity defenses across 18 critical areas, ranging from asset management to data protection and network security.


text: A cornerstone of our cybersecurity governance is the annual performance of comprehensive cybersecurity risk assessments. These assessments evaluate our defenses against the latest cyber threats and vulnerabilities and support our preparedness to respond to evolving cyber risks. The insights gained from these assessments inform our ongoing efforts to review and refine our cybersecurity strategies, policies and defense mechanisms. As a core component of our risk management process, all employees are required to participate in annual information security training.


text: We engage third parties annually to evaluate our information security posture, risks, and third-party service provider solutions as part of our overall enterprise risk management activities. The company maintains an inventory of vendors and third-party providers and evaluates those providers for risks annually at a minimum.


text: Cybersecurity Incidents and Responses We have not experienced cybersecurity incidents that have materially affected our company, our business strategy, our results of operations, or our financial condition. However, we continue to face cybersecurity risks and recognize that we must remain vigilant against known and evolving threats. For additional detail about our cybersecurity risks and whether any such risks are reasonably likely to materially affect our company, please see the discussion in Item 1A, "Risk Factors."


text: Our commitment to cybersecurity resilience includes an ongoing monitoring program and a well-defined incident response plan that provides clear guidelines for mitigating the impact of any future cyber threats and incidents. These processes are periodically reviewed and updated to address emerging threat intelligence.


text: Future Directions Urgently will continue to invest in cybersecurity technologies, enhance our staff training programs, and foster collaborations with cybersecurity experts. Our board-driven, proactive approach to cybersecurity risk management is integral to our mission of delivering value to our customers, employees, and shareholders, safeguarding our reputation, and ensuring the long-term success of our company.


text: Cybersecurity Risk Management and Strategy We have developed and implemented cybersecurity risk management practices intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management practices include a cybersecurity incident response plan.

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management practices include but are not limited to: • risk monitoring and assessments designed to help identify material cybersecurity risks from cybersecurity threats to our critical systems, information, products, services, and our broader enterprise IT environment; • internal and external IT professionals responsible for managing our (1) cybersecurity risk analysis, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assist with aspects of our security controls; • cybersecurity awareness training of our employees and senior management; and • a breach response and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: Although we face risks from cybersecurity threats, no known cybersecurity threats have materially affected or we believe are reasonably likely to materially affect us, including our business, financial condition, results of operations and growth prospects. See "Risk Factors – Significant disruptions of our or our vendors' information technology systems or cybersecurity incidents could result in significant financial, legal, regulatory, business, and reputational harm to us."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of our Board (the "Audit Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Audit Committee receives reports at least annually from management on our cybersecurity risks and would be informed of any cybersecurity incidents that management considers to be significant or potentially significant.


text: Our internal cybersecurity professional reports to our CEO and is responsible for assessing and managing our material risks from cybersecurity threats. The CEO is supported by our Chief Legal Officer in exercising primary oversight for our overall cybersecurity risk management program. Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: Danimer Scientific, Inc.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and leverage testing by our internal audit team, tabletop exercises, and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. The results of these assessments are reported to our Audit Committee.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: Our Vice President of Information Technology leads our internal IT team and is responsible for overseeing our information security program. Team members who support our information security program have relevant educational and industry experience. Our IT team members provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings. We also participate in a cybersecurity risk insurance policy.


text: For additional information regarding cybersecurity threats that may materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "If we experience a significant disruption in our information technology systems, including security breaches, or if we fail to implement new systems and software successfully, our business operations and financial condition could be adversely affected."


text: One of the functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole and through its committees. Particularly, the Audit Committee of the Board of Directors oversees our cybersecurity risk and receives regular reports from our Vice President of Information Technology on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Risk Management and Strategy Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, the Company has implemented a comprehensive Information Security Program ("Program") which is a component of its overarching enterprise risk management program. The Program is achieved through a collaborative effort involving operations, technology, compliance, risk, and senior management. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Key components of the risk management program include: • A risk assessment process that identifies and prioritizes material risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • Third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • A patch management system that safeguards our environment by keeping software up-to-date and resilient against threats. • Internal and external penetration testing that is conducted and reviewed either by independent third parties or qualified employees. • A third-party risk management program that is designed to ensure our vendors meet our cybersecurity requirements. • A training and awareness program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested at least annually.


text: Governance and Oversight The Board of Directors, including its Risk Subcommittee provides oversight of Company cybersecurity risks. The Board of Directors receives periodic reports on cybersecurity threats, awareness training, and key risk indicators related to cybersecurity. Additionally, the Company's Audit Committee provides oversight as it relates to annual audits related to information technology and cybersecurity. Management promptly reviews results of these audits to initiate necessary remediation, which are then reviewed by the Audit Committee.


text: The Board of Directors has designated the Security Committee and Incident Response Team with responsibilities related to information security and cybersecurity.


text: The Security Committee is a management committee with representation from operations, technology, compliance, risk, and senior management. The Security Committee monitors, reviews, and makes necessary changes to the Information Security Program. This Committee provides accountability for policies and procedures and reviews incidents that may affect information security.


text: The Incident Response Team has overall authority and responsibility for preparing and responding to incidents and consists of various sub-teams including representation from operations, technology, risk, compliance, human resources, and marketing. While key personnel have identified roles, this team ensures appropriate reports, statuses, and decisions are presented to the Executive Management and the Board of Directors.


text: The Company's Chief Technology Officer ("CTO") oversees the Company's information technology programs and investments. The Company's CTO has over 30 years of information technology experience. The Company's Compliance and Security Officer, who oversees the Company's information security programs, has over 10 years of experience and reports to the Chief Operating Officer. The Compliance and Security Officer is designated as the program coordinator responsible for coordinating and overseeing the Information Security Program.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including because of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, refer to Item 1A, Risk Factors of this Form 10-K.


text: Risk Management and Strategy We continue to assess and improve the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. We value the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security law. Our cybersecurity risks, and the controls designed to mitigate those risks, are included as a part of our overall risk management governance which is reviewed at least annually by our board of directors.

companyName: CV Sciences, Inc.

ticker: CVSI


text: Our IT networks and related systems are critical to the operations of our business and essential to our ability to successfully perform day-to-day operations. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a component of our internal control system. Cybersecurity awareness, including specific topics related to social engineering and email fraud, are included in our employee handbook. We have processes and controls, in particular with respect to our financial and reporting technology, to prevent and minimize cybersecurity risks and attacks. We rely on industry-standard third-party software and vendors for our core systems, including data storage, analysis and backup.


text: Our board of directors is responsible for overseeing our cyber security risk management and strategy. Our AVP Logistics, Systems & IT is responsible for managing our outside technology services and has over 10 years of relevant experience. The AVP Logistics, Systems & IT reports directly to our Chief Financial Officer and reviews cybersecurity assessments with our Chief Financial Officer on a regular basis. Our Chief Financial Officer is responsible for escalating any cybersecurity matters as appropriate. The Audit Committee of our board of directors will regularly review cybersecurity requirements and risks on a quarterly basis.


text: While we believe we have implemented appropriate measures and controls for our business, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, to our knowledge, there have been no incidents materially affecting the Company, but a material incident could result in disruption of critical IT networks and systems, impeding our operations, release of confidential information, and/or corruption of data. Such an incident could damage our reputation, brands, future sales and could expose us to potential liability.


text: Gaia recognizes the critical importance of maintaining robust cybersecurity measures to protect our systems, data, and operations and to maintain the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, including the management of risks arising from cybersecurity threats. It is our policy to provide regular updates to our shareholders regarding material cybersecurity incidents and the steps taken to address them. We believe that transparency in this area is crucial to maintaining trust and confidence in our operations.

companyName: GAIA, INC

ticker: GAIA


text: We have implemented a comprehensive cybersecurity program designed to identify, assess, and mitigate potential threats and vulnerabilities, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program includes regular risk assessments, network monitoring, penetration testing and incident response protocols. We also provide regular, mandatory training to our personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Our Senior Director of Operations/IT and his team work collaboratively across the Company and with our board of directors and management to maintain our cybersecurity program and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our board of directors and management receive periodic cybersecurity updates from our Senior Director of Operations/IT, which may include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to our cybersecurity program. The Company's Senior Director of Operations/IT has served in various roles in information technology and information security at Gaia for over 17 years.


text: Our commitment to cybersecurity extends beyond our internal operations. We work closely with trusted third-party vendors and partners to ensure that they also meet our rigorous security standards. We utilize third-party cloud computing services as part of our global business operations. We also employ the use of third-party content delivery networks (CDN) to help us stream content in high volume to our members over the internet. Problems faced by Gaia or any of our third-party cloud computing or other network providers, involving technological or business-related disruptions, as well as cybersecurity threats, may have an adverse impact on the member experience.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company to date, including our business strategy, results of operations or financial condition.


text: We are committed to protecting our information systems against cybersecurity threats. Any cybersecurity incident can adversely affect our business and disrupt our operations as described in greater detail in our Risk Factors relevant to cybersecurity risks. Our senior leadership, in consultation with our board of directors, has assigned responsibilities for ensuring and overseeing the operation of our information security program to the Marchex Information Security Committee (the "ISC") comprised of senior representatives of departments across our organization.

companyName: MARCHEX INC

ticker: MCHX


text: Effective risk management is a critical component of our operations. The ISC conducts a formal cybersecurity risk assessment annually. The assessment methodology is designed to identify cybersecurity threats to our information systems and considers a range of relevant risk factors that include both intentional and unintentional human acts by our or our vendors' personnel, or malicious third-party actors, risks inherent to technology/equipment we and our service providers use, as well as natural and environmental risks. The ISC discusses and documents mitigation strategies based on the risks identified. Results of assessments are reported to senior leadership and our board of directors. To the extent that any control deficiencies or material changes in the threat environment are identified, the ISC may make recommendations for new or improved controls and threat mitigation strategies.


text: The ISC also oversees day-to-day cybersecurity risk mitigation efforts, which include, but are not limited to monitoring systems for availability, performance, and security issues, periodic vulnerability scans, penetration testing performed at least annually by independent, reputable, third-party vendors, as well as evaluating any risk(s) associated with prospective third-party service providers who require access to sensitive customer data and implementing any additional controls to address significant risks identified. Furthermore, the ISC meets quarterly to discuss and analyze any relevant developments within the organization and industry relative to cybersecurity, reviews our internal policies and operational procedures relevant to cybersecurity at least annually, and promulgates updates when deemed necessary or advisable.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including, without limitation, intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal data (including sensitive personal data such as biometric data and employment-related data) ("Information Systems and Data").

companyName: Veritone, Inc.

ticker: VERI


text: Our Chief Information Officer ("CIO"), our Vice President of Information Security (who serves as our Chief Information Security Officer ("CISO")), and the Company's information security function help identify, assess and manage the Company's cybersecurity threats and risks. This team identifies and assesses risks from cybersecurity by monitoring and evaluating our threat landscape and the Company's risk profile using various methods, including, for example, manual and automated tools in certain environments and systems, subscribing to threat intelligence reports and services, scanning our environment for certain threats, evaluating our risk exposure, evaluating and analyzing certain reported threats, collaborating with law enforcement on certain threat intelligence, conducting internal and external cybersecurity audits, performing threat assessments in certain environments and systems, conducting vulnerability assessments in certain environments and systems, and engaging third-party experts for red/blue team testing and tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, vulnerability management, disaster recovery and business continuity planning, risk assessments, encryption of certain data, network security controls in certain environments and systems, data segregation of certain data, access controls for certain environments and systems, physical security, asset management, vendor risk management, employee cybersecurity training, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting and cloud-hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes the administration of a security questionnaire for certain providers, evaluation of certain provider's written security program, and review of security assessments and reports from certain providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factors captioned "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—The security or operation of our platform, networks, computer systems or data, or those of third parties upon which we rely, may be breached or otherwise disrupted, and any such breach or other disruption could have an adverse effect on our business and reputation" and "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—Interruptions or performance problems associated with our technology and infrastructure, or that of our third party service providers, including AWS and Azure, may adversely affect our business and operating results."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our CIO, who has over 20 years of expertise in overseeing corporate information technology functions, and our CISO, who has 20 years of experience in the cybersecurity industry.


text: Our CIO and CISO are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our CIO and CISO are also responsible for approving cybersecurity budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Company's Chief Executive Officer, CIO, security management team, and our legal team (including privacy). These stakeholders work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports, summaries or presentations from the CISO concerning the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity and other information technology risks. The audit committee oversees management’s implementation of our cybersecurity risk management program. Pursuant to its charter, the audit committee’s oversight of the integrity of our information technology systems and cybersecurity risks includes the review and assessment with management of the adequacy of controls and security for our information technology systems, processes and data, as well as our contingency plans in the event of a breakdown or security breach affecting our information technology systems.


text: As part of its oversight, the audit committee will receive reports from management on our cybersecurity risks including any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The audit committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, management may from time to time directly provide the full Board with briefings on our cyber risk management program, including presentations on cybersecurity topics from our Security Officer, internal security staff or external experts as part of the Board’s continuing education on topics that impact public companies.


text: Our management team, including our Director of Information Technology and our Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team’s experience includes 30 years of professional experience in all aspects of IT including enterprise software development, enterprise infrastructure design and configuration, development of integration infrastructure for health care systems and financial trading systems and technical support.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Program We have implemented a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: password protection; multi-factor authentication; monitoring and alerting systems for internal and external threats; and regular evaluations of our cybersecurity program.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response Plan, which includes an Incident Response Process in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our head of administration will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Process to guide the response.