text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to identifying, and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly alert, identify, scope, triage, escalate, contain, eradicate mitigate and recover from cybersecurity incidents by providing management visibility and to enable management to take action with respect to reporting of material incidents in a timely manner. • Technical Safeguards: Our program consists of layered defenses to enhance resiliency within the system to prevent, detect and respond to any incidents. Our perimeter security includes but is not limited to, proactive threat intelligence via our security partners, firewalls, end-point security agents, email security, vulnerability assessments and scans, proactive patching, and privileged access management. Our detection capabilities include event logging and monitoring such as unsuccessful login attempts, escalated privilege attempts, anomaly detection. Our response capabilities are supplemented by a 3rd party breach response process through our insurer's cyber panel, which includes access to a breach coach and forensic experts under a tripartite agreement to ensure coordinated response and maintain privilege; security playbooks setting forth a tactical guide to respond to cybersecurity events and threats as they occur; and recovery procedures. We have also implemented various technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are published in monthly cybersecurity dashboards that are shared with our CFO. Based on the monthly reports, the CFO, with support from the VP of Information Technology, evaluates and provides a summary report to the Audit Committee on an annual basis. We review and train our employees on our cybersecurity policies, standards, processes, and practices annually or more frequently depending on needs identified within the monthly cybersecurity dashboards.

companyName: Canopy Growth Corp

ticker: CGC

secItem: Item 1C


text: The Audit Committee oversees the Company's risk management program, including the management of cybersecurity threats. The Audit Committee receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses the Company's approach to overseeing cybersecurity threats with the Company's CFO and other members of senior management.


text: The VP of Information Technology, in coordination with our senior management team, including the CFO, work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: The VP of Information Technology has been with our Company for over six years, previously serving as Director and subsequently Senior Director of Global IT Engineering. Prior to joining our organization, he was the Founder, President, and CEO of RjR Innovations, a recognized North American leader in IT Service Management. Over the course of his 27-year career within the Information Technology industry, he has established himself as a subject matter expert and thought leader, having served as both an ITIL Best Practice Conference and Keynote Speaker at various industry events. Supporting the VP of Information Technology is the Director of Cybersecurity & IT Engineering, a seasoned IT professional with more than 25 years of comprehensive experience spanning infrastructure, cybersecurity, architecture, and operations. He has been with our Company for over five years, during which he has held key roles including Senior Solutions Architect, Global IT Engineering and Network Engineer, Global IT Operations. He has also successfully completed advanced executive programs in cybersecurity leadership, including CISO and CISM certifications.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, have not materially affected and are not reasonably likely to materially impact our operations materially, including our business strategy, results of operations, or financial condition.


text: Cybersecurity is one of the top operational risks facing TMCC. We and other financial institutions continue to be targets of ever evolving cybersecurity threats and cyberattacks. As a result, we devote significant resources to a cybersecurity program designed to minimize such risks and protect TMCC, along with data from our customers and clients.

companyName: TOYOTA MOTOR CREDIT CORP


text: Cybersecurity Risk Management and Strategy TMCC's cybersecurity program is designed to identify and assess internal and external cybersecurity threats to and within TMCC's business and operations and to take action aimed at protecting the Company, mitigating and managing cybersecurity risk, and in time of attack, to respond expeditiously to minimize the impact of the attack.


text: Managing cybersecurity threats is a component of our broader enterprise risk management program, which establishes a risk management framework that seeks to identify, assess, and monitor risks that could materially impact our business, customers, clients, employees and stakeholders.


text: TMCC's cybersecurity program utilizes a variety of controls that are designed to identify, prevent, detect, respond to, and recover from cybersecurity threats and events. Those processes and controls include: • dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity risk policies and standards, implementing controls, monitoring the environment, and responding to cybersecurity incidents; • periodic cybersecurity awareness training for employees and contractors on our policies and emerging cybersecurity threats, including phishing awareness; • internal and independent cybersecurity testing, including penetration testing and tabletop exercises, to assess vulnerabilities of our information systems and evaluate our cyber defense capabilities, technical safeguards and resiliency; • identifying and managing cybersecurity risk of our critical third-party suppliers; • periodic cybersecurity risk assessments for our information systems and applications; • cybersecurity monitoring and response processes employing cross functional teams to identify, assess, escalate, investigate, contain, and remediate incidents; and • incident response and recovery plans.


text: As part of TMCC's cybersecurity program, TMCC engages with assessors and third-party advisers to perform various services, including assessments of process design and operating effectiveness; security testing and attestation; periodic assessment of enterprise cybersecurity maturity; industry benchmarking; and thought leadership related to continuous improvement of processes, training, technology, and data.


text: TMCC's cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third-party service providers with access to TMCC's systems and data, as well as such third-party service providers' adherence to certain cybersecurity standards and processes. As appropriate, TMCC requires such third-party service providers to agree to be subject to cybersecurity evaluations by TMCC.


text: Although our third-party service providers have experienced cybersecurity incidents, which have resulted in minor adverse impacts to our business, we have not experienced material losses or other material consequences related to cybersecurity incidents experienced by us or our third-party service providers. We expect to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the continuously evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party service providers, will not have a material adverse effect on our business, results of operations and financial condition. Further discussion of how TMCC's business, results of operations and financial condition may be materially adversely affected by risk from cybersecurity threats is contained in Item 1A. Risk Factors, Regulatory, Legal and Other Risks, "A security breach or a cyber-attack could adversely affect our business, results of operations and financial condition."


text: Cybersecurity Governance The Board of Directors (the "Board") has risk oversight responsibility for the cybersecurity and data privacy risk management programs of TMCC, which are administered directly and with assistance from the Cybersecurity Committee of the Board.


text: The purpose of the Cybersecurity Committee is to assist the Board in fulfilling its oversight responsibility with respect to its information technology use and protection, including enterprise cybersecurity and data privacy, among other things. The Cybersecurity Committee receives, reviews, and discusses reports from members of management, as appropriate or required by law, including but not limited to the Chief Information Officer, Chief Information Security Officer, Chief Risk Officer, Chief Legal, Compliance and Administrative Officer, and other officers or employees as appropriate, regarding TMCC's practices, management and functioning of technology operations and information security, cybersecurity and data privacy risks. The Cybersecurity Committee reports to the Board regarding its activities, its receipt of reports regarding material cybersecurity and data privacy issues, material issues found in vulnerability assessments or penetration testing, and reports from the Chief Information Officer and Chief Information Security Officer.


text: Our information security team works closely with key stakeholders, including regulators, government agencies, law enforcement, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.


text: TMCC's cybersecurity program is administered by our Chief Information Security Officer. We believe our Chief Information Security Officer and our information security team have the appropriate expertise, background, and depth of experience to manage cybersecurity and data privacy risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, information security leadership roles, military experience, academia, ongoing internal and external training, and regular discussions with consultants and industry peers with applicable knowledge and expertise regarding emerging cybersecurity threats.


text: When a cybersecurity threat or incident is identified, the Chief Information Security Officer works closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provides information to senior management, the Cybersecurity Committee, and the Board, as necessary, regarding significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, employees and stakeholders, and continues to provide regular reports until such incidents are concluded.


text: We believe cybersecurity is critical to advancing our technological advancements. As a pharmaceutical and biotechnology services company, we face a multitude of cybersecurity threats that include attacks common in most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks and have developed our own practices and framework, which we believe enhance our ability to identify and manage cybersecurity risks. Our Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The IT Risk Committee and our cybersecurity consultant, which has extensive information technology and program management experience, regularly brief the Audit Committee on our cybersecurity and information security posture and the Audit Committee is apprised of any cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Audit Committee retains oversight of cybersecurity because of its importance. In the event of any incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Audit Committee, as appropriate.


text: Additionally, we must also comply with extensive regulations, including requirements imposed by the FDA related to adequately safeguarding patient information. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges.


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We will require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk Factors" for a discussion of cybersecurity risks, including, without limitation, the risk factor under the heading "We may be subject to security breaches or other cybersecurity incidents that could compromise our information and expose us to liability". Except as set forth therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management procedures ("CRMP") intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our CRMP consists of procedures designed for Graham Corporation and certain subsidiaries and separate procedures designed specifically for BN. Our CRMP includes cybersecurity incident response plans ("IRPs") for Graham Corporation and BN. The purpose of the IRPs are to provide a structured and systematic incident response process for all Information Security Incidents that affect any of our or our subsidiaries' information technology systems, network, or data, including data of ours and our subsidiaries held, or IT services provided by, third-party vendors or other service providers.

companyName: GRAHAM CORP

ticker: GHM


text: O ur CRMP is integrated into our overall enterprise risk management program. We have designated our Senior IT Manager to oversee the implementation and maintenance of the IRP for Graham Corporation. For BN, we have designated BN's IT Manager to implement and maintain the IRP for BN. Our IT personnel at Graham Corporation and BN have over 50 years of combined experience in the field of cybersecurity and are responsible for the management of our cybersecurity and data privacy programs. Among other information security duties, the Senior IT Manager and IT Manager are responsible for the following for Graham Corporation and BN, respectively: • implementing the IRP; • identifying and managing an incident response team ("IRT") principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, appropriately escalate, make decisions regarding, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on identified cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; and • periodically reviewing the IRP whenever there is a material change in our business practices that may reasonably affect its cybersecurity incident response procedures.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment including risks associated with ransomware; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor onboarding as well as risk-based monitoring of vendors on an ongoing basis.


text: We are currently in the process of integrating P3 into our CRMP and IRPs processes for BN. We expect such integration to be completed during fiscal 2026.


text: We may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.


text: Our Audit Committee, through their responsibilities designated to them in the Audit Committee Charter, oversees cybersecurity risk management as part of its risk oversight function and oversees management's implementation of our CRMP.


text: The Audit Committee receives periodic reports from management and the IT Managers for Graham Corporation and BN on our cybersecurity risks at least annually. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our Senior IT Manager and IT Manager regularly inform our management team of all aspects related to cybersecurity risks and incidents. This is designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes and practices, which are integrated into the Company's overall risk management system. To protect the Company's information systems from cybersecurity threats, the Company uses various security technologies and tools that help the Company identify, escalate, investigate, manage, resolve and recover from security incidents in a timely manner. These efforts include: • ongoing collection of threat intelligence and environment awareness through monitoring, • data protection management and vulnerability monitoring through data loss prevention and exfiltration tools, • cybersecurity risk management processes and practices, • control assurance, • secure development of new products, • identity and access management, • incident response, auditing and monitoring, and • maintaining a 24x7 security operations center to allow for always available incident response.

companyName: NetApp, Inc.

ticker: NTAP


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company follows an incident escalation process that is incorporated into its incident and risk management processes. In the event the Company identifies a cybersecurity incident, its senior management, consisting of the Chief Financial Officer, Chief Information Security Officer (CISO), Chief Administrative Officer, and Executive Vice President of Business Technology and Operations review the facts and circumstances involved in such cybersecurity incident, or series of related cybersecurity incidents.


text: The Company partners with third parties to assess the effectiveness of its cybersecurity prevention and response systems and processes, including third-party review of the Company's Information Security Management System for ISO 27001 controls, assessment of the Company's cloud products and managed services according to the American Institute of CPAs (AICPA) Service Organization Control (SOC) Audit Type II, and new product validation as part of the Company's secure development lifecycle. The Company additionally engage s third-party providers in support of endpoint detection and responses, data loss prevention efforts, and incident management efforts.


text: To date, the Company is not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of cybersecurity risks and potential related impacts on the Company, refer to the risk factors in Part I, Item 1A. "Risk Factors," including "If a material cybersecurity or other security breach impacts our services, systems, supply chain, or end-user customer systems, or if stored data is improperly accessed, our business could suffer significant harm."


text: NetApp's Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the Board of Directors oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframes. The Company's CISO regularly updates each of the Board of Directors and the Audit Committee at least twice a year. Such updates include a review of cybersecurity risks affecting the Company, related metrics, and any incidents or issues that require attention from the Board of Directors.


text: The CISO provides leadership, strategic direction, and oversight for NetApp's Global Security Risk and Compliance functions and security program. Global Security executives oversee management of risks and track projects progress, remediations, and any issues related to cybersecurity risks.


text: NetApp's CISO is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 30 years of experience in IT and information security, including over 16 years with NetApp in roles of increasing seniority, and is a Certified Information Security Auditor, Certified Information Security Manager with ISACA and a Certified Information Systems Security Professional with ISC2. The CISO stays informed on information security risks through regular meetings on key cybersecurity projects and KPIs. Updates are communicated to the Global Security Steering Committee, which provides quarterly reports to the Board of Directors and to the Audit Committee.


text: Risk Management and Strategy As a publicly traded e-commerce outdoor company, we are acutely aware of the importance of robust cybersecurity measures in safeguarding our information assets, operational integrity, and reputation. Our approach to cybersecurity risk management is integrated into our broader risk management framework and overseen by our Board of Directors.

companyName: Outdoor Holding Co

ticker: POWW


text: We have established comprehensive processes to assess, identify, and manage material risks from cybersecurity threats. These processes include continuous evaluation of potential threats, regular security assessments of third-party service providers, and stringent monitoring procedures to mitigate risks related to data breaches and other security incidents. We periodically engage third-party consultants, legal advisors, and audit firms to evaluate and assess our risk management systems and to assist in the remediation of potential cybersecurity incidents, as necessary.


text: Our Information Security Program (the "Program") is designed to protect personal and proprietary information in compliance with federal and state requirements. The Program aims to: • ensure the security and confidentiality of employee and customer personal information, as well as Company proprietary information; • protect against anticipated threats or hazards to the security or integrity of such information; and • prevent unauthorized access to, use of, or transfer of such information, thereby protecting the Company, its employees, and customers from potential harm or inconvenience.


text: We use a variety of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises, to enhance our cybersecurity posture. Our incident response plan is comprehensive, detailing procedures for preparing for, detecting, responding to, and recovering from cybersecurity incidents. This plan includes processes for triaging, assessing the severity of, escalating, containing, investigating, and remediating cybersecurity incidents, while ensuring compliance with relevant legal obligations. In addition to internal measures, we manage cybersecurity risks associated with third-party suppliers, particularly those with access to our systems or confidential data. We perform due diligence on critical third-party suppliers and monitor identified cybersecurity threats. We require these suppliers to contractually agree to manage their cybersecurity risks according to our standards or to submit to cybersecurity audits conducted by our agents.


text: We regularly engage third-party experts to conduct information security testing, including penetration testing, on our systems and infrastructure. The Program undergoes periodic external assessments aligned with the National Institute of Standards and Technology Cybersecurity Framework and the Payment Card Industry Data Security Standard. This alignment helps us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Board of Directors oversees our cybersecurity risk management. Directors receive reports as requested from management, including senior IT leadership and third parties, on cybersecurity matters. Additionally, the Board of Directors is kept informed about cybersecurity risks as part of our overall enterprise risk management program and through regular business updates.


text: Senior IT leaders and compliance officer are responsible for developing and implementing appropriate cybersecurity programs and ensuring our compliance with applicable laws and regulations. These leaders, equipped with relevant degrees, certifications, and extensive work experience, are informed by their cybersecurity teams about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity incidents.


text: Information regarding cybersecurity risks is communicated through various channels, including direct discussions between key leaders and Company management, and reports to the Board of Directors and its committees. The Board of Directors regularly receives updates from our compliance officer and senior IT leadership on the status of our cybersecurity measures and any significant developments.


text: Our commitment to cybersecurity is a fundamental aspect of our operational strategy, ensuring the protection of our information assets, the continuity of our operations, and the trust of our stakeholders.


text: We have experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on our business strategy, results of operations, or financial condition to date, any actual or perceived breach of our security could damage our reputation, adversely affect our operations, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of sales." and "A failure of our information technology systems, or an interruption in their operation due to internal or external factors including cyber-attacks, could have a material adverse effect on our business, financial condition or results of operations." in Item 1A "Risk Factors" of this Annual Report.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management ("ERM") approach, which is subject to oversight by our Board.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a cybersecurity program that endeavors to identify risks, protect assets, detect threats, respond to incidents, and recover from damaging events in a prompt and effective manner with the goal of minimizing business disruptions through effective governance of people, processes, and technologies. • External Collaboration: We collaborate with a third-party service provider to identify, assess, and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations, and sensitive information from cybersecurity threats, including compromises of our information systems and our data's confidentiality, integrity, and availability. These include firewalls, disaster recovery capabilities, malware and ransomware prevention, access controls, and encryption. • Education: We provide monthly training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities, and access of the relevant Company personnel. Our policies require all workers to report any actual or suspected cybersecurity events. • Incident Response Planning: We have established and maintain incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which a material incident would be communicated to executive management, our Board, external regulators, and shareholders. • Governance: Our Board's oversight of cybersecurity risk management is led by the Board's audit committee (the "Audit Committee"), which oversees our ERM program. The Audit Committee reviews cybersecurity threats, risks, and mitigation on at least an annual basis, and such reviews include internal and independent assessments of risks, controls, and overall program effectiveness.


text: Our risk assessment efforts have indicated that we are a potential target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors, including nation-states, organized criminal groups, malicious insiders, and activists. The impacts of attacks, abuse, and misuse of the Company's systems and information include, without limitation, loss of assets, operational disruption, and damage to the Company's reputation.


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through assessments, and other exercises focused on evaluating the sufficiency and effectiveness of our cybersecurity risk management efforts. If a material weakness in our cybersecurity risk management program is identified, it will be reported to the Audit Committee and the Board, as appropriate, and we will make adjustments to our cybersecurity processes and practices as necessary to eliminate or compensate for that weakness.


text: Our CFO is principally responsible for overseeing our cybersecurity risk management program in partnership with other Company management. We believe our business leaders, including our CFO, have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats. Our CFO collaborates with other Company business leaders and our third-party service provider to maintain a program designed to manage our exposure to cybersecurity risks and to respond to cybersecurity incidents promptly.


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes, and practices that management implements to operationalize our cybersecurity risk management program. The Audit Committee will promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates. The Audit Committee periodically discusses our approach to cybersecurity risk management with our CFO, who oversees the Company's information systems.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition at this time.


text: Our overall information security risk management approach is designed to enable us to assess, identify and manage major risk exposures, including from material risks from cybersecurity threats, in a timely manner. As part of our information security risk management program, we perform risk assessments in which we map and prioritize information security risks identified through the processes described below. These assessments inform our information security risk management strategies and oversight processes and we view cybersecurity risks as one of the key risk categories we face.

companyName: ORACLE CORP

ticker: ORCL


text: We believe that Oracle is a target for computer hackers, cyber threats and other bad actors because our products and services store, retrieve, process and manage large amounts of data, including sensitive data. We and our vendors are regularly subject to attempts by third parties to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures and gain unauthorized access to our or our customers', partners' and suppliers' software, hardware and cloud offerings, networks and systems.


text: If a large scale cyberattack or other major security incident results in unauthorized access to or modification or exfiltration of a significant amount of our customers' or suppliers' data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we could incur significant expenses and suffer substantial damage to our brand and reputation, and this could result in a material impact on our business. Refer to "Data Privacy, Cybersecurity and Intellectual Property Risks" in Risk Factors included in Item 1A within this Annual Report for additional discussion of the challenges we encounter with respect to cybersecurity risks.


text: During fiscal 2025, Oracle experienced cybersecurity incidents that, to date, have not had a material impact on our business, including our business strategy, results of operations or financial condition.


text: Our corporate security and information security programs are designed to help us prevent, prepare for, detect, respond to and recover from cybersecurity threats. We leverage industry standard security frameworks to evaluate our security controls. Relevant personnel collaborate with subject matter experts throughout the process to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate a potential security incident. We continually conduct security and privacy reviews to pinpoint risks associated with our products, services and enterprise. We also employ various monitoring tools to track suspicious or anomalous activity across our networks, systems, and data, and we simulate cyber threats to proactively address vulnerabilities. Finally, we routinely train our employees on cybersecurity matters.


text: This program includes processes for triaging, assessing the severity of, escalating, containing, investigating and remediating information security events, as well as meeting legal obligations and minimizing customer impact and brand and reputational damage. In addition, we maintain insurance to protect against potential losses arising from a cybersecurity incident. Periodic tabletop exercises are conducted to test and reinforce our incident response controls, with incident severity and priority assessed on an ongoing basis.


text: We also conduct external and internal risk management audits to assess and report on our internal incident response preparedness and help identify areas for continued focus and improvement. We conduct periodic penetration testing to identify vulnerabilities in our products, services, and systems. We also undergo security-related industry certifications and attestations by external auditors, including System and Organization Controls (SOC) 1, SOC 2, International Organization for Standardization (ISO) 27001, 27017 and 27018, Cloud Security Alliance Security Trust Assurance and Risk (CSA STAR), Payment Card Industry Data Security Standard (PCI DSS) and other compliance frameworks. Additionally, our vendor risk management program identifies and mitigates risks associated with third-party service providers, including those within our supply chain and those with access to our customer or employee data or systems. We use the findings from these and other processes to review our information security practices, procedures and technologies.


text: Cybersecurity is an important area of focus for our Board. Our information security risk management program is designed to allow our Board to establish a mutual understanding with management of the effectiveness of our information security risk management practices and capabilities, including the division of responsibilities for reviewing our information security risk exposure and risk tolerance, tracking emerging information risks and ensuring proper escalation of certain key risks for periodic review by the Board of Directors and its committees. As part of its broader risk oversight activities, the Board oversees risks from cybersecurity risks, both directly and through the Finance and Audit Committee of the Board (the F&A Committee). As reflected in its charter, the F&A Committee assists the Board with the management and assessment of privacy and data security risk and is responsible for reviewing and discussing with management privacy and data security risk exposures, including, among other things, the potential impacts of those exposures on our business, financial results, operations and reputation. The F&A Committee also oversees our internal controls over financial reporting, including with respect to financial reporting-related information systems.


text: As an element of its information security risk management oversight activities, the F&A Committee reviews the results of our incident response control tests, external and internal audits and penetration testing and oversees our vendor risk management program. The F&A Committee also receives quarterly updates regarding cybersecurity matters from senior management. In turn, the F&A Committee reports to the full Board on a quarterly basis regarding the F&A Committee's cybersecurity risk oversight activities. We also have Board members with expansive knowledge and expertise in the area of cybersecurity. In addition to these regularly scheduled updates, our Chief Privacy Officer and Senior Vice President, Cloud Security and Head of Global Information Security may also report to the F&A Committee on how certain information security risks are being managed and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats that have been detected by the information security team.


text: Robert Duhart, Senior Vice President, Cloud Security and Head of Global Information Security is responsible for the day-to-day identification, assessment and management of the information security risks we face. Our Senior Vice President, Cloud Security and Head of Global Information Security has extensive experience in managing cybersecurity and has served in various leadership roles in information technology and cybersecurity at several large public companies, the U.S. Department of Defense and the Federal Bureau of Investigation. Most recently, he served as the Chief Information Security Officer, eCommerce and Deputy Chief Information Security Officer at a major retailer. Our Senior Vice President, Cloud Security and Head of Global Information Security earned a master's degree in technology management from George Mason University – Costello College of Business, and a Chief Information Security Officer Executive Certificate from Carnegie Mellon University – Heinz College of Information Systems and Public Policy.


text: Our Senior Vice President, Cloud Security and Head of Global Information Security is supported by team members who have relevant educational and industry experience. These team members provide regular reports to the Senior Vice President, Cloud Security and Head of Global Information Security and work closely with our Chief Privacy Officer and include personnel dedicated to information security, product security, and physical security. Informed by the processes and practices discussed under "Risk Management and Strategy" above, team members escalate cybersecurity threats and incidents to the Senior Vice President, Cloud Security and Head of Global Information Security who assesses the severity of such threats and incidents for inclusion in quarterly update to the F&A Committee where appropriate. In addition to the ordinary-course Board and F&A Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including cybersecurity risks.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including conducting scans of the threat environment and conducting threat and vulnerability assessments. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats, including risk assessments, incident detection and response, end-point detection and response, network security controls, access controls, physical security, systems monitoring, a vendor risk management program, and penetration testing. We work with third parties (including professional services firms, threat intelligence service providers, and penetration testing firms) from time to time that assist us to identify, assess, and manage cybersecurity risks.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Our information security team reviews enterprise level cybersecurity risks at least annually, and key cybersecurity risks are identified, tracked, monitored, and addressed in alignment with our overall enterprise risk management program.


text: We utilize third-party service providers to perform certain business functions. We seek to engage reliable and reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we may review the cybersecurity practices of such provider, contractually impose obligations on the provider, conduct information security risk assessments, and conduct periodic reassessments during their engagement.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are subject to cybersecurity risks, including risks related to customer, employee, vendor, and other company data" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: The Audit Committee is responsible for overseeing risks from cybersecurity threats, in accordance with its charter. The Audit Committee holds quarterly meetings and receives periodic reports from our Vice President – Information Technology (Chief Information Officer) concerning our significant cybersecurity threats and risks, and the processes we have implemented to address them.


text: Management plays an important role in assessing and managing our material risks from cybersecurity threats. Our Chief Information Officer – which is the management position responsible for assessing and managing material risks from cybersecurity threats – is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. He has over a decade of experience leading cybersecurity oversight, and leads other members of our information security team, who have professional cybersecurity experience, training, or certifications.


text: We maintain a cyber incident response plan that is designed to provide a framework that will allow us to respond effectively to a cybersecurity incident. A cyber emergency response team, which includes members of our executive leadership team, manages this plan. This team meets periodically to discuss cybersecurity threat trends and related information. Our incident response processes are designed to escalate certain cybersecurity incidents to our cyber emergency response team and include reporting to the Audit Committee for certain cybersecurity incidents.


text: We view cybersecurity threats as a shared responsibility. All new employees with company email addresses receive cybersecurity training as part of their onboarding, as well as annual training. We also periodically publish a cybersecurity newsletter to these employees related to topics such as phishing, social engineering, and insider-threat awareness.


text: Risk Management and Strategy We have established processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we use or will use, transmit, receive, and maintain. The processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into the overall risk management system through the use of firewalls, antivirus and malware detection, and other security software. The processes include efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks. We have engaged consultants to assist us with risk mitigation and monitoring threats from both inside and outside our network, including risks of cybersecurity threats associated with the use of third-party service providers. We maintain full backups on a regular basis to protect against the loss of critical data.

companyName: Rocky Mountain Chocolate Factory, Inc.

ticker: RMCF


text: We have not experienced any material cybersecurity incidents to date that have materially affected, or that are reasonably likely to materially affect our business, strategy, results of operations or financial condition, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including to our results of operations and financial condition. We rely extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks.


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. The Board's Audit Committee routinely evaluates the Company's cybersecurity through communications with management and the Company's information technology department. Systems are in place to perform ongoing testing to defend and mitigate against unwelcome intrusions and attacks.


text: The interim CEO and CFO communicate with the head of the information technology department daily to monitor any potential or perceived threats to our technology infrastructure. A comprehensive and regularly tested Incident Response Plan (IRP) has been established that outlines specific steps for various types of cyber incidents. There are key performance indicators (KPIs) and metrics used to measure the effectiveness of the cybersecurity program, including processes to keep senior management and the Board's Audit Committee informed. The Company also maintains a cybersecurity insurance policy to provide financial protection in the event of a critical breach.


text: We employ information technology specialists and use external consulting firms to supplement our cybersecurity practices. Both the interim CEO and CFO have experience in managing teams of information technology specialists and assessing cybersecurity threats.


text: Our Board and Audit Committee oversee risks from cybersecurity threats. Our Audit Committee reviews cybersecurity risks on a quarterly basis and our Board periodically reviews cybersecurity risks as part of its overall risk management oversight and specifically reviews cybersecurity in detail at least annually. Our Board relies on management and its use of the third-party consultants for expertise for assessing and managing our risks from cybersecurity threats. In conjunction with management, our Board considers the nature of the work provided by our operations, the potential impact of a cybersecurity event, costs, potential likelihood of an event, prior events, and benefits in its general oversight of the cybersecurity risk management.

companyName: ORION ENERGY SYSTEMS, INC.

ticker: OESX


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining limited access to our information and systems, and we could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. See also "Item 1A. Risk Factors — Operational Risks."


text: Cybersecurity is a significant and integrated component of Central Plains Bancshares, Inc. risk management strategy. As a financial services corporation, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, The Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect The Company.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information and network security, data management, business continuity and disaster recovery, privacy, third-party risk management, and incident response. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration and vulnerability tests, monitor systems, perform cybersecurity risk assessments, and conduct audits.


text: The Information Technology Department is primarily responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the IT Manager who reports directly to the Executive Vice President/Chief Operations Officer (COO). The IT Manager has more than seven years of experience with the Company and additional years of experience in the information technology ("IT") field. The IT Manager is assisted in overseeing Information Technology by an IT Managed Service Provider firm. The IT Manager and COO oversee the information security program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security & Network System Policy identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster).


text: The Information Technology Department conducts on-going meetings and reviews with the IT Managed Service Provider to ensure the latest threats and vulnerabilities are addressed. This includes patch management. Quarterly external penetration and vulnerability testing is conducted by a third-party IT audit firm. Business continuity/ disaster recovery testing and incident response plan testing is conducted annually by the Board appointed Disaster Recovery Committee. In addition, the company participates in annual disaster recover exercises with its core IT system provider. The Board appointed Technology Committee provides oversight of policies and receives updates including cybersecurity, systems, IT assets and control policies. The COO is a member of the Technology Committee and the Disaster Recovery Committee and information from committee meetings and testing is reported to the Board.


text: The Company has implemented an Incident Response Plan to provide a structured incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the COO.


text: On a periodic basis, but not less than annually, the COO, with the assistance of IT Department and Compliance/Risk Management staff, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessments, the Company's processes and policies may be revised to protect against any anticipated threats or hazards to the security or integrity of such information.


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested when possible. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit, and Testing Regular internal monitoring is integral to the risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration and vulnerability testing to test the effectiveness of security controls and preparedness measures is conducted at least annually (generally quarterly for external testing and every 12 to 18 months for internal testing) or more often, if warranted by the risk assessment or other external factors. The COO and IT Manager determine the scope and objectives of the penetration and vulnerability analysis and audits.


text: Service Providers Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the company maintains a Vendor Management Program, which is implemented through a Vendor Management Program Policy and includes an onboarding process and periodic reviews of vendors with access to sensitive data. The Vendor Management Program is audited as part of IT audits.


text: Employees and Training Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the company. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: At least annually, the Annual Electronic Data Processing Report & Risk Assessment is presented to the Board. The report provides an overview of IT operations, core providers, IT policies, audit and testing information, and IT strategic accomplishments and future planned IT initiatives. The report also includes an IT Risk Assessment and risk matrix. IT audit findings are included on the Master Exam/Audit Tracking Report of Action Items which is presented to the Board bi-monthly.


text: Program Adjustments The COO, with the assistance of the IT Manager, monitors, evaluates, and adjusts the Information Security & Network Systems Policy considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan To ensure that information security incidents can be recovered from quickly and with the least impact to the company and its customers, the company maintains an Incident Response Policy which is designed to work in conjunction with the Disaster Recover/Business Continuity Plan. The COO is responsible for implementing and maintaining the Incident Response Policy.


text: Risk Management and Strategy We are committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets. We are committed to ensuring the security and protection of our Company's information assets and the personal information of our employees, and other stakeholders.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: We recognize that cybersecurity threats are constantly evolving and have the potential to cause significant harm to our Company and our stakeholders. In order to address these risks, we have established a cybersecurity risk management framework that is aligned with industry best practices and regulatory requirements.


text: Our program includes regular risk assessments, vulnerability management, access controls, incident response planning, and employee training and awareness programs. We also work closely with third-party service providers to ensure that they are meeting our cybersecurity standards.


text: There can be no assurance that our cybersecurity program will prevent all incidents. In the event of a cybersecurity incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our capabilities to address evolving threats. We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our Company or our stakeholders.


text: During the fiscal year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company personnel. The Company also utilizes an external agency with long term expertise in cybersecurity. The external agency is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee will receive periodic reports from our management concerning cybersecurity issues, including certain threats and risks and the processes the Company has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We have established a comprehensive, enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. This program is seamlessly integrated into our overall risk management and internal control systems, subject to regular reviews by senior management.

companyName: Cineverse Corp.

ticker: CNVS


text: By conducting regular risk assessments, we believe we effectively manage both internal and external cybersecurity threats. Our cybersecurity strategy is specifically tailored to our organization's size, scope, and business needs, emphasizing the protection of data. Our security infrastructure includes advanced tools and protocols, such as firewall protections, secure user authentication, and up-to-date antivirus and internet security software, which we believe are fundamental components of our operational protocols designed to mitigate vulnerabilities and efficiently address security incidents. We also periodically assess and manage cybersecurity risks associated with our third-party service providers.


text: The ongoing improvement of our cybersecurity measures is overseen by our Senior Vice President of Corporate Systems. We do not employ or engage any third-parties for cybersecurity consulting or monitoring, aside from technical support teams from our application vendors.


text: In the normal course of business, we proactively manage and monitor cybersecurity activities. To date, these efforts have successfully prevented any incidents that could materially affect our business strategy, operational results, or financial condition. We remain vigilant and are not currently aware of any threats that pose a material risk.


text: We believe our detailed incident response procedures enable us to effectively manage and mitigate the impacts of security breaches. Continuous monitoring and post-incident analysis further refine our security strategies, enhancing our protective measures. Our Board and the Audit Committee provide oversight over our cybersecurity efforts and stay regularly informed on cybersecurity matters, including emerging risks and mitigation strategies, to ensure informed governance over our enterprise risk assessments and cybersecurity approach. Cybersecurity matters are discussed regularly with senior management, and any significant cybersecurity events are promptly reported to the Board.


text: For additional information about cybersecurity risks, see Risk Factors, Any significant disruption in or unauthorized access to our computer systems or those of third-parties that we utilize in our operations, including relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, harm to our reputation, disclosure or destruction of data, or theft of intellectual property, including digital content assets, which could adversely impact our business.


text: Risk management and strategy We depend on information systems and technology in substantially all aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. We have a risk-based cybersecurity program, dedicated to protecting our data and information technology systems. These cybersecurity threats and related risks make it imperative that we remain vigilant and apprised of developments in the information security field, and we expend considerable resources on cybersecurity. With Board of Directors and Audit Committee oversight, we assess and manage the material risks associated with cybersecurity as part of our risk management process.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: We work with industry-leading third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, legal advisors, threat intelligence service providers, and penetration testing firms. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response plan, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or third-party partner could materially adversely impact us. To address this, our vendor management process involves different levels of assessment depending on the services provided by the vendor, the sensitivity of the related information systems and data, and the identity of the provider. It is designed to help identify cybersecurity risks associated with a vendor and work with the vendor to address or mitigate those risks.


text: While we have experienced threats to our data and systems, to date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. That said, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition in the future. For further information regarding cybersecurity risks, see Item 1A, "Risk Factors" in this Annual Report.


text: Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks, including cybersecurity. The Board of Directors is responsible for regularly reviewing with management our cybersecurity practices and policies. As part of its oversight role, the Board of Directors receives regular reporting about our strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through quarterly updates from the Chief Information Officer ("CIO") who is also our Chief Information Security Officer ("CISO").


text: Our cybersecurity program and related initiatives are managed by the CIO/CISO, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.


text: Our CIO/CISO, who has more than 25 years of experience in technology and information security risk management across a number of organizations, is responsible for overseeing the risks related to cybersecurity. He is responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing senior leadership with regular updates on cybersecurity-related matters.


text: Our security operation center monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: In the event of a suspected incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the CIO/CISO and functional areas (e.g. legal) as appropriate. The CIO/CISO will make any required communications to the Chief Executive Officer (CEO) and other senior leadership, with the CIO/CISO making any required communications to the Board and Audit Committee. Our CEO, Chief Financial Officer, General Counsel and CIO/CISO are responsible for assessing such incidents for materiality, ensuring that any required notification, disclosure or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information with the aim to continually improve security to keep pace with the evolving cyber threat landscape.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: Our strategy toward managing cybersecurity risk in our business is informed by and aligned with the core principles and methods outlined within the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, while including elements of the International Organization for Standardization's ISO/IEC 27001 publication and industry best practices. This does not mean that we seek to meet any particular technical standards, specifications, or requirements, only that we intend to use the NIST CSF or ISO 27001, and other resources as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Inclusive in these frameworks and our program are components for continuous improvement through feedback, self-review and external testing.


text: Our cybersecurity program leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. As part of our cybersecurity program, we maintain various protections designed to safeguard against cyberattacks, including but not limited to firewalls, endpoint detection and response, anti-malware, immutable backups, multi-factor authentication schemes, data encryption, and security system information event monitoring to detect and respond quickly to any emergent threats. In addition, we periodically conduct intrusion and penetration testing through third parties to evaluate our cybersecurity response capability.


text: We also maintain a security awareness program with mandatory semi-annual training content and perform automated e-mail based phishing tests. Results of testing help to inform and provide continuous improvement of our security awareness training materials, approaches and strategies. We routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques, and how to avoid them, and the best use of our established communications channels.


text: We perform a formal cybersecurity risk assessment each year. As part of our risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to our operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program.


text: In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments designed to identify, assess, and manage cybersecurity risks, and to evaluate our overarching information security program and specific incident response procedures. We perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we continue to invest in this diligence regarding our critical vendors, our control over the security posture of our vendors is limited, and there can be no assurance that we can prevent or significantly mitigate the risk of any compromise or failure in the information assets owned or controlled by such vendors.


text: The Vice President of IT is responsible for implementing and maintaining the information security program. The Vice President of IT role is currently held by an individual who has over 20 years of experience in enterprise-level IT operations and management, cybersecurity operations and management and IT/Cyber architecture and strategy. The Vice President of IT reports to our CFO, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our CFO meets with the Audit Committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of risk remediation and ongoing implementation of cybersecurity improvements across our organization.


text: The Vice President of IT engages with our managed service providers to proactively address emerging threats based on industry reports and respond to any threats and incidents. Our managed service providers also provide continuous support and coverage of our environment. We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats.


text: Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the Audit Committee of our board of directors' oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The relevant members of management regularly update the Audit Committee with respect to cybersecurity risk, also on an ad-hoc basis as necessary, regarding any material cybersecurity incidents and any incidents with lesser impact potential. The Audit Committee periodically reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks that may adversely affect our business, financial condition and results of operations. See Item 1A. Risk Factors, "Our business and operations would suffer in the event of system failures, cyberattacks or a deficiency in our cybersecurity" for further discussion.


text: Our Board of Directors (the "Board") recognizes the importance of cybersecurity and safeguarding our information systems and data assets. It is imperative that we maintain the trust and confidence of our customers, business partners and employees. Protecting our data and the data of our customers, business partners and employees is critical to maintaining that trust. As such, the Board is actively involved in overseeing our cybersecurity risk management program.

companyName: CULP INC

ticker: CULP


text: Risk Management and Strategy We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls.


text: Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our enterprise risk management program, we actively work to identify, prevent, and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur. Our approach includes using select third-party resources, including external cybersecurity consultants, auditors, and technologies, along with our internal staff, to benchmark, measure, and improve our cybersecurity risk management systems and processes, and ensure alignment with industry best practices.


text: We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities; • Third-Party Risk Management – regular evaluation and monitoring of our network of external partners, vendors, suppliers and service providers, which includes monitoring of third parties, securing vendor remote access, and implementation of protections against cyber threats that may arise through business-to-business system integrations; • Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls; • Incident Response Plan - a cybersecurity incident response plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; • Assessments – annual cybersecurity assessments, administered by a third-party specialist, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks; • Training - security awareness training for all salaried personnel that highlights critical organizational risks through monthly phishing simulation campaigns, "lunch and learns," and annual cybersecurity learning modules; • Insurance - cybersecurity insurance policies and periodic reviews of our policies and coverage levels; and • Monitoring Legal/Regulatory Developments - review of emerging data protection, data privacy, and other relevant cybersecurity laws and regulations to determine appropriate changes to cybersecurity controls and processes.


text: Through the aforementioned processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—Increasing dependence on information technology systems comes with specific risks, including cybersecurity breaches and data leaks, which could have an adverse effect on our business."


text: Our Board of Directors has delegated to its Audit Committee primary responsibility for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on our cybersecurity program, including regular presentations regarding our cybersecurity risks; our efforts to address evolving standards; vulnerability assessments, including results of third-party penetration testing; and external audits of our cybersecurity IT controls. Management and the Board also receive prompt and timely information regarding any significant or potentially significant cybersecurity incident and our remediation efforts.


text: Our Vice President of Information Technology and our Director of Technical Infrastructure, in coordination with management, work to implement our program to protect the Company's information systems from cybersecurity threats. These individuals work to promptly evaluate and address any cybersecurity incidents, and work with management to assess the impact and any necessary remediation efforts following a cybersecurity incident. In addition, the Vice President of Information Technology provides updates to the Audit Committee and the Board on a regular basis and as needed in response to specific incidents. To facilitate the success of our cybersecurity risk management program, we have assigned our Director of Technical Infrastructure and his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and provide reports to management.


text: Our Vice President of Information Technology and Director of Technical Infrastructure have a combined 65 years of experience designing, implementing, and supporting information technology systems with a security-first mindset. In particular, prior to joining Culp, our Director of Technical Infrastructure gained experience leading cybersecurity teams at a managed security service provider, where he provided cybersecurity support to outside organizations.


text: Risk Management and Strategy We are committed to protecting the confidentiality, integrity, and availability of our systems and information. Our security program is intended to assess, identify, and manage risks from cybersecurity threats, and is aligned with the National Institute of Standards and Technology Version 2.0 Cybersecurity Framework ("NIST CSF"). The NIST CSF provides a flexible model for identifying and managing cybersecurity risks. Our security infrastructure uses a layered controls approach, incorporating various capabilities guided by the NIST CSF and other industry standards and best practices. We routinely invest in our security processes and capabilities, including those related to our risk management and assessment programs, vulnerability and intrusion detection, incident response plans, and other advanced detection, prevention, and protection capabilities.

companyName: PAYCHEX INC

ticker: PAYX


text: We conduct regular assessments of cybersecurity risks to identify threats to us and potential vulnerabilities that could negatively affect our business operations if exploited. We track cybersecurity risks within our enterprise risk management system with cybersecurity threats considered to be among the top-priority risks to us. In addition, our Enterprise Security Organization (the "ESO") conducts technical risk assessments, and, in some instances, we engage with third-party experts to assist with or perform technical risk assessments. The results of these risk assessments are reported to management. Our processes require escalation of significant cybersecurity risks to management and Paychex's Audit Committee derived from the Board of Directors (the "Board").


text: The ESO is led by our Chief Information Security Officer ("CISO") and seeks to maintain a consistent, resilient, and secure infrastructure by partnering with resources across the Company. The ESO implements numerous cybersecurity processes and capabilities, which include but are not limited to: assessing risk associated with significant infrastructure or operational changes and the introduction of new technologies; administering our third-party service provider risk management program; managing secure software development and change management; managing access management and logical access controls, identifying security vulnerabilities through automated scanning technologies; performing penetration testing and due diligence assessments; and protecting the confidentiality, integrity, and availability of the Company's data in transit. The ESO includes the activities of the Paychex Cyber Fusion Center, which provides 24x7x365 cybersecurity monitoring and incident response. We maintain incident response plans which outline the escalation, investigation, reporting, and overall response procedures depending on the type and severity of incidents.


text: As part of our security program, we require all employees to take information security awareness training upon hire and annually thereafter. We provide additional ongoing training to our employees about security best practices and awareness, including internal phishing simulations.


text: We maintain a program designed to assess and manage the cybersecurity-related risk associated with third-party service providers that we rely on as part of providing solutions to our clients. This program incorporates a risk-based approach based on service criticality and type of information. Vendor risk assessments are performed and documented within our vendor management system. As part of the vendor risk assessment, we conduct an information security program evaluation of critical third-party providers before engagement and, based on our assessment of the vendor's risk, contractually require certain third parties we engage to implement security programs commensurate with their risk profile.


text: As of May 31, 2025, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, and financial condition. We continue to invest in cyber-resilience and cyber-threat response preparedness as we anticipate ongoing risks from cybersecurity threats. Refer to the "Risk Factors" section contained in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.


text: Cybersecurity risks are overseen by the Audit Committee of our Board. Annually, the Audit Committee reviews an assessment of our risk management processes with the Board. The Audit Committee is responsible for reviewing significant cybersecurity risk exposures and the steps management has taken to monitor, control, and report such exposures. The Audit Committee receives quarterly updates from our CISO regarding our cybersecurity risk management program. These updates include a status of current capabilities, ongoing initiatives, and the evolving cybersecurity threat landscape.


text: Our management is responsible for implementing our security program, which is overseen by our Security Governance Council (the "SGC") that regularly reports to our Chief Executive Officer and Audit Committee. The SGC is chaired by our CISO and is comprised of senior leaders and key personnel throughout the Company to support cross-functional representation. The members of the SGC are comprised of our executives and managers who understand our business operations, including but not limited to individuals from the following departments: Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management. The SGC meets on a quarterly basis with the mission to develop, coordinate, and sustain the organization's enterprise security program; coordinate and respond to security risks and incidents; and develop, implement, and maintain the organization's enterprise security strategy in alignment with, or in support of, business goals and objectives. The recommendations of the SGC are considered when updating the information security policies, procedures, and standards at Paychex.


text: Our CISO has over two decades of experience in various roles involving information security: developing and implementing cybersecurity programs to protect the confidentiality, integrity, and availability of information systems and data. Our CISO has earned relevant degrees and holds several information security certifications, including the Certified Chief Information Security Officer certification. Prior to joining Paychex in September 2019, he served as VP and CISO at a publicly traded company in the HCM industry. Before that, he held security leadership positions at several banks, insurance companies, and professional services firms.


text: Our CISO reports to our Vice President of Platform and Technology Services, who has over two decades of technology leadership experience and has earned a relevant degree. Our VP of Platform and Technology Services leads the teams responsible for the Company's core technology platforms. Prior to joining Paychex in October 2012, he held senior technology leadership positions at two telecommunications companies.


text: Cybersecurity Risk Management and Strategy The Company is committed to maintaining a robust cybersecurity risk management program designed to identify, assess, and mitigate cybersecurity risks, including those related to data breaches, phishing, ransomware, insider threats, third-party relationships, software vulnerabilities, regulatory compliance, cloud security, artificial intelligence, and end-user computing. We are constantly evolving our cyber defenses to prevent and minimize impacts from cyber threats by using a multi-pronged approach that helps safeguard our assets and data.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: We maintain and process a range of sensitive information, including Personally Identifiable Information (PII), Protected Health Information (PHI), financial data, intellectual property, and other regulated or proprietary information. Our cybersecurity management program is designed to protect confidentiality, integrity, and availability of information systems and sensitive data. The program is aligned with cybersecurity frameworks and governance standards such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and NIST SP 800-53, and the International Organization of Standardization (ISO) 27001 information security management system framework as a structured approach to identifying, assessing, and mitigating cyber risk. Our cybersecurity management program includes the following elements: Policies and Procedures: Processes are documented to formalize the implementation of the cybersecurity program.


text: Continuous Monitoring: Use of automated tools and third-party services for real-time threat detection, vulnerability scanning, penetration testing, and incident alerting. Security Incident Response Plan: A formal plan that includes containment, eradication, recovery, and communication protocols.


text: Third-Party Risk Management: We assess the cybersecurity posture of third-party suppliers, vendors, and other partners through due diligence, including assessments at the initiation of the relationship and on an ongoing basis appropriate to the cyber risk. Training and Awareness: All Kestra team members, including senior management, receive mandatory cybersecurity training and periodic phishing simulations. Periodic risk assessment: We periodically re-assess the cybersecurity program for continuous improvement and to account for emerging risks.