text: Our cybersecurity governance framework includes documented policies, procedures, and controls designed to mitigate cybersecurity risk. We also perform regular risk assessments of our infrastructure, network architecture, and software/systems using current threat intelligence received from a variety of sources. We employ various preventative and detective controls to block, monitor, and alert for suspicious activity. Additionally, we engage third-party experts to perform periodic internal and external assessments, including penetration testing and vulnerability scanning. We also maintain an ongoing education and training program designed to increase employee awareness and gauge risks relative to the human element. Moreover, we maintain a third-party risk management program designed to identify, assess, and mitigate risks, inclusive of cybersecurity risk, associated with third-party service providers and Hanover's supply chain vendors. Lastly, we engage third-party audit firms to periodically assess our IT general controls and information security.


text: We also maintain an Incident Response Plan that provides a structured framework for addressing potential or actual cybersecurity incidents. The Incident Response procedures and detections/prevention mechanisms are continuously refined to address evolving threats and alerts. This Plan includes the timely notification, escalation, and reporting of cybersecurity incidents to the Bank's Operational Risk Management Committee, Enterprise Risk Management Committee, and the Board of Directors and/or the duly designated ERM Committee of the Board of Directors. It also includes for the timely notification to regulatory agencies, including but not limited to the FDIC, DFS, FRB and SEC as required or deemed appropriate. We also undertake periodic simulations and tabletop exercises to test our Incident Response Plan and ensure business resiliency and proper incident response management.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR

secItem: Item 1C


text: Cybersecurity Governance Our Senior Information Security Officer ("SISO"), who is supported by a team of specialized Information Security and Third-Party Risk Management Analysts, is primarily responsible for the development, oversight, and administration of our Information Security, Business Continuity, and Vendor Risk Management Programs. The SISO has over 25 years of experience in information security, information technology, and enterprise risk management and holds certifications as both a Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Auditor ("CISA"). The SISO is an active member of the following management-level committees: Incident Response Committee, IT Steering Committee, Change Control Committee, Product Management Committee, Project Management Committee, and Operational Risk Management Committee ("ORMC"). The SISO reports to the ORMC on a quarterly basis, or more frequently if needed, regarding the effectiveness and status of the cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments.


text: The SISO reports directly to the Chief Risk Officer ("CRO"), who has over 35 years of experience in enterprise risk, audit, and compliance. The CRO maintains oversight of entity-wide risk management, inclusive of but not limited to cybersecurity risk.


text: The SISO meets regularly with and works collectively with the Bank's Chief Information Officer ("CIO") and various members of the Information Technology Department as well as third-parties we may employ to assist in this area. The CIO has over 30 years of experience in Information Technology.


text: The SISO also reports to Hanover's Board Enterprise Risk Management Committee on a quarterly basis, or more frequently if needed. Similar to the SISO's management-level reporting, the SISO reports on the overall cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments. The SISO also provides an annual Information Security report to the full Board of Directors and executive leadership team on the overall cybersecurity program, including material risks, key risk indicators, and emerging trends.


text: The ultimate responsibility, among management, for effective risk management, including cybersecurity risk, resides with the Chief Executive Officer ("CEO"). The Bank's CEO and SISO annually certify compliance to the NYSDFS as required under DFS regulations.


text: Material Cybersecurity Risks, Threats, and Incidents Our cybersecurity program has been designed to mitigate risks from cyber-attacks. However, even with a strong internal control environment designed to mitigate risks, Hanover is keenly aware that risks cannot be entirely eliminated. Notwithstanding our cybersecurity program's effectiveness, the threat posed by cyber-attacks remains substantial. Additionally, we maintain cybersecurity insurance designed to further reduce residual risk. Nevertheless, due to the continuously shifting and evolving threat landscape and global geopolitical events, a portion of cyber risk remains inherently beyond full mitigation.


text: While we have experienced cybersecurity incidents in the past, we do not believe any of these incidents have materially affected or are reasonably likely to materially affect the Company or its operations and financial condition.


text: Risk Management and Strategy Our operations include the creation, collection and maintenance of sensitive information, including proprietary and confidential business information, intellectual property, third-party information and employee information. To protect this information, we use external and internal services to managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats on a constant basis. In addition, we use multi-factor authentication (MFA) for external use, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impacts. We establish incident response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: We have implemented a Data Protection Policy, or the DPP, in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of our information, data and assets, and to manage identified material cybersecurity risks. The DPP was prepared using relevant guidance issued and technology standards that are used across various industries. It applies to all entities who are using our equipment and resources, including but not limited to, employees and temporary workers. Our Senior Director, Information Technology, is a certified information security officer (CISO). He is primarily responsible for implementing and overseeing the DPP and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.


text: Our DPP includes an incident response process that includes reporting thresholds and follows standardized identification and authentication practices. If an incident is identified, it is documented by our Senior Director, Information Technology, who is required to report the incident to management.


text: We work with third-party service providers from time to time that assist us to identify, assess and manage cybersecurity risks, including professional SEIM SOC and other services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing.


text: No risks from cybersecurity threats have occurred that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director, Information Technology, who reports to our Sr. Vice President, Operations. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our incident response process involves management, who participates in our disclosure controls and procedures.


text: Our incident response process is designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with our incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to our Board of Directors for certain cybersecurity incidents.


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. Our Chief Financial Officer and IT consultant provide periodic briefings to the Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, if any, cybersecurity systems testing, activities of third parties, and the like.


text: See " Risk Factors – Our internal computer systems, or those used by our third-party contractors or consultants, may fail or suffer security breaches, resulting in liability and harm to our reputation, which could negatively affect our business, results of operation and financial condition. We may face liability if we breach our obligations related to the protection, security, nondisclosure of confidential information or disclosure of sensitive data or fail or are perceived to fail to comply with applicable data protection laws and regulations, or consumer protection laws, regulations and standards. "


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. As a financial services company, cybersecurity threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This strategy includes employee training, innovative technologies, and policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response.


text: The Company leverages a variety of industry frameworks and regulatory guidance to develop and maintain its information systems and cybersecurity program, including but not limited to Interagency Guidelines Establishing Information Security Standards, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook (with particular emphasis on the FFIEC's Information Security and Business Continuity Management Handbooks), FFIEC Cybersecurity Assessment Tool, Gramm-Leach-Bliley Act ("GLBA") 501(b), and the Center for Internet Security ("CIS") Critical Controls Framework. In addition, the program leverages certain, third-party benchmarking, audits, and third-party threat intelligence sources to facilitate and enhance the effectiveness of the program.


text: Core activities supporting the Company's strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Company and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups stored at off-site locations and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations, and these third-party vendors continue to be a source of operational and informational risk. Accordingly, the Company utilizes a third-party risk management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.


text: As indicated above, supporting the operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. As such, the Company engages third-party consultants and independent auditors to conduct penetration tests, cybersecurity risk assessments, external audits, and program development and enhancement where applicable.


text: Cybersecurity Governance Management Oversight. The Chief Technology Officer oversees the Information Technology Department which, among other things, is responsible for identifying, assessing and managing material risks from cybersecurity threats and has more than thirty years of experience in the information technology field. The Chief Technology Officer is a member of various management committees and participates in Board of Directors' meetings as well as Audit Committee meetings where the overall status of information technology and security is discussed including the related policies and risk assessments. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for policy and program enhancements.


text: Further, the Chief Technology Officer is a member of the Compliance Committee chaired by the Chief Compliance Officer, which consists of members of senior and executive management, as is it charged with maintaining Bank-wide compliance with relevant statutes, regulations, and interpretations as well as consumer protection.


text: Board Oversight. The Board of Directors is responsible for reviewing the overall policies and practices for risk management, including delegation of oversight for particular areas of risk to the appropriate subcommittees. Collectively, the Board of Directors and its subcommittees are responsible for discussing with management major financial risk exposures as well as significant operational, compliance, reputational, strategic and cybersecurity risks, and the steps management has taken to monitor and manage such exposures to be within the Company's risk tolerance.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed to align with industry standards and incorporates best practices such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: We have also established an interdisciplinary Cybersecurity Incident Response Team ("CIRT"), which is responsible for our incident response plan, our security controls, and for assessing incidents reported by our information technology security team. In addition, our cybersecurity risk management program includes: Monitoring and evaluation of our vulnerability performance.


text: Implementation of processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our critical systems and information. For any agreements with service providers that do not contain acceptable protections, we are working to put them in place on an ongoing basis.


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment. We use a third-party consultant to provide us with advisory, project execution, and operational support in connection with cybersecurity and to conduct NIST assessments and vulnerability evaluations. Cybersecurity awareness training of our employees, contractors, incident response personnel, and senior management.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches and geopolitical tensions or conflicts, such as the ongoing war in Ukraine or conflicts in the Middle East, may create a heightened risk of cyberattacks."


text: Cybersecurity Governance Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors encourages management to promote a culture that incorporates risk management into our corporate strategy and day-to-day business operations. Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: Management discusses strategic and operational risks at regular management meetings and conducts specific strategic planning and review sessions throughout the year. Throughout the year, senior management reviews these risks, including with respect to cybersecurity, with the Board of Directors at board meetings from time to time as part of management presentations that focus on particular business functions, operations or strategies and presents the steps taken by management to mitigate or eliminate such risks. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could adversely affect our business, data or information systems that we use or own.


text: Our Vice President of Information Technology, as head of our information technology team, leading our cybersecurity efforts, oversees the day-to-day administration of our cybersecurity program. Our CIRT has members that include our Chief Executive Officer, Chief Financial Officer, Vice President, Corporate & Securities Law, and Vice President of Information Technology. As key members of our management team, our Chief Executive Officer, Chief Financial Officer, and Vice President of Information Technology have approximately a combined 48 years of risk management experience and are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Key members of our information technology management team collectively possess over 16 years of hands-on experience in implementing a diverse array of cybersecurity initiatives. Their expertise spans both cloud and on-premise IT infrastructure and applications/systems, cultivated through extensive engagement across various regulated environments.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We have invested time and resources with a goal to define, implement and further develop the maturity of our cybersecurity risk management and strategy program. During this time, we have developed a common cybersecurity incident response plan across our businesses and jurisdictions that while unique to the risk profile of each business, allows us to utilize common response and decision-making protocols in an effort to react quickly to a potential cybersecurity threat and manage risk to our overall Company.

companyName: ATN International, Inc.

ticker: ATNI


text: In developing our cybersecurity incident response plan and assessing the maturity of our cybersecurity threat program, we utilize the National Institute of Standards and Technology Cybersecurity Framework (NIST). We use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We make it a practice to continually review the maturity of our program, utilizing the NIST standards and leveraging the feedback of both internal resources and external advisors in an effort to continuously improve our program in relation to evolving cybersecurity threats in our industry.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program overseen by our Risk Council, composed of professionals across a variety of departments and jurisdictions in our organization. Our cybersecurity program utilizes methodologies, reporting channels and governance processes across our subsidiaries that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that are assessed and reviewed when onboarding new vendors, customers, product lines or shifts in our service delivery models.


text: Our cybersecurity risk management program includes: risk assessments performed internally and with the help of third-party vendors that are designed to help identify material cybersecurity risks to our critical systems, information, products, services, equipment, and our broader enterprise IT and customer-facing network environments;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our response to cybersecurity incidents, and (4) our assessment of new products and business processes;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with the analysis of our security controls and those of our key vendors;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: To date, we have not experienced any prior cybersecurity incidents that have materially affected our operations, business strategy, results of operations, or financial condition. For a discussion of risks that could in the future impact our operations, business strategy or financial condition, please see " Cybersecurity breaches could have an adverse effect on our business " in our Risk Factors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity in connection with its general risk assessment and oversight. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives frequent, and typically no less than quarterly reports from management on our cybersecurity risks, assessment of our cybersecurity program, and development of our information security incident response plan. In addition, management updates the Committee, pursuant to an agreed upon timetable and escalation matrix regarding any material cybersecurity incidents, as well as providing the Committee with periodic reports on any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management from time to time on our cyber risk management program. Board members receive presentations and training on cybersecurity topics from our Chief Information Officer (CIO), Vice President of Security, or external experts as part of the Board's continuing education on topics that impact public companies. Our CTIO is an experienced information technology professional with just under 30 years of experience in the networking and communications industries. His extensive experience extends to all facets of information technology, including enterprise applications, cloud and SaaS systems, network infrastructure, and network management. For the past decade, he has been at the forefront of cloud systems development and security. Our VP of Security has over 30 years of experience in IT and Security and has the Certified Information System Security Professional (CISSP) certification as well as various technology vendor certifications.


text: As referenced above, our Risk Council is responsible for day-to-day cyber risk management, and reports to the Audit Committee on these matters. Our management team, including our General Counsel, who serves as the lead of our Risk Council, and our CIO are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our internal security team is made up of experienced professionals that have an average of more than 25 years of IT and security experience, including certifications such as CISSP, CompTia Security+. We also have developed an internal training program to develop new talent within our organization and work with vendor and third-party training programs to mentor and educate these team members to expand and enhance the capabilities of our team.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through various means, which may include briefings from internal security personnel; and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving our enterprise value. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. The Company's Information Security Officer is primarily responsible for developing, monitoring, and implementing our cybersecurity program, which establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Chief Technology Officer is responsible for implementing the appropriate controls and monitoring them towards adherence with the established standards.

companyName: First Foundation Inc.

ticker: FFWM


text: As a regulated financial institution, we have designed our cybersecurity program based on the requirements of the Gramm-Leach Bliley Act of 1999 and Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool. Our processes for identifying, assessing and managing material risks from cybersecurity threats rely on the FFIEC Cybersecurity Assessment Tool as well as recurring audits and assessments of our cybersecurity program and controls. As part of our cybersecurity program, we have developed an incident response plan based on industry-standard cybersecurity frameworks, with procedures for responding to and remediating a cyber-incident. We also review and test our incident response plan through simulations and assessments. Further, we employ recurring security awareness training for employees and produce recurring security awareness material for our customers.


text: We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third-party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our Information Security Program team's protocols in partnership with the vendor management, enterprise risk management, and internal audit departments.


text: Our business, financial condition and results of operations have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A—"Risk Factors" of this Annual Report on Form 10-K.


text: Cybersecurity Governance The Board of Directors, through the Audit Committee and Directors' Risk Committee, provides direction and oversight of the Company's risk management system. Our Chief Technology Officer is responsible for managing our information security team, while our Information Security Officer is responsible for maintaining and continuing to develop and implement our cybersecurity program enterprise-wide and assessing and managing risks from cybersecurity threats. Both the Information Security Officer and Chief Technology Officer have extensive experience in the banking industry and in information technology and information security. The Information Security Officer has served in information security roles for twenty-five years and in banking for thirty-five years. The Chief Technology Officer has been with the Company since 2010 and has over twenty years of experience in information technology and cybersecurity within the banking industry.


text: We have processes to inform the Directors' Risk Committee, Audit Committee and the Board about risks from cybersecurity threats. Our management team reports its findings using the FFIEC Cybersecurity Assessment Tool and our information security team's determination as to whether our security controls, at a minimum, are in place and effective. The Information Security Officer and Chief Technology Officer regularly report to the Director Risk Committee, Audit Committee and the Board regarding cybersecurity and related threats and trends, changes, control effectiveness and residual risk, the areas where our cybersecurity program may be improved and improvements made to address and remediate issues.


text: We evaluate our cybersecurity strategy annually, including our processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein, within our overall enterprise risk management framework. Our cybersecurity strategy takes a multi-faceted approach, one which focuses on the following key areas: (i) the human element within the Company; (ii) perimeter security; (iii) network security; (iv) application security; (v) endpoint security; and (vi) data security. We use a wide array of processes, mechanisms, controls, technologies, systems, strategies and tools to address these areas, including but not limited to: routine security awareness training, formal evaluations of third-party applications, password strength policies, antivirus software, firewalls, routine patch management, encryption software, data backups and data redundancies, email security software, multi-factor authentication tools, network security monitoring, and web vulnerability scanning.

companyName: XOMA Royalty Corp

ticker: XOMA


text: We engage outside consultants on a regular basis to help us design internal controls and processes that are intended to help address cybersecurity risks. We also leverage these outside consultants and other third parties, when appropriate, to implement appropriate processes, policies, and internal controls designed to help prevent, detect, and/or mitigate these cyberthreats.


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. These threats include but are not limited to: (i) ransomware and malware attacks; (ii) endpoint attacks; (iii) compromised business email and other social engineering threats; and (iv) vulnerabilities related to inadequate patch management. Our licensees, suppliers, contractors, and consultants also face similar cybersecurity risks, which could have an adverse impact on our business.


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the headings "If our information technology systems or data or those of our partners or contractors are compromised, our business could experience adverse consequences, including regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; and loss of revenue, income, or profits" and "Compliance with the stringent and changing obligations related to data privacy and security is an onerous and resource-intensive process. Our actual or perceived failure to comply with any data privacy or security obligations could lead to regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; loss of revenue, income, or profits; loss of customers or sales; and other adverse business consequences."


text: Our management, led by our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer, is responsible for assessing cybersecurity risks and for overseeing our cybersecurity strategy to assess and manage those risks, including responding to attacks or breaches. Our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer each have experience in senior leadership roles in which they have been responsible for an entity's enterprise risk management, including management of cybersecurity risks. The Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer regularly communicate with those responsible for daily IT operations and infrastructure to assess potential cybersecurity threats and determine whether updates to the cybersecurity strategy are necessary.


text: We also maintain an Incident Response Plan that sets forth a protocol in the event we are exposed to a cyber-attack or breach. The Incident Response Plan provides a framework for our response, including the appropriate communication and escalation channels.


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee of the Board, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. Management provides regular updates to the Audit Committee of the Board regarding risk assessments, developing threats, and the current and planned cybersecurity strategy, and promptly provides notification of significant attacks or breaches as part of the Incident Response Plan. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to our Information Technology Steering Committee, Audit Committee and to our board of directors. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, the Federal Financial Institutions Examination Council ("FFIEC") guidelines. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Technology Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The Information Security Program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions. We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Our Information Security Officer has 24 years of experience working for financial institutions and has served in the role of Chief Information Officer and Chief Information Security Officer. He is a certified and active Certified Information Security Manager ("CISM") professional. Our Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact and cyber security awareness. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by department managers and include the Information Security Officer and Chief Technology Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts.


text: The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents discussed at committee meetings and the actions taken to the Information Technology Steering Committee on a quarterly basis (or more frequently as may be required by the Incident Response Plan). The Information Technology Steering and Audit Committees are responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Technology Officer provide quarterly reports to the Information Technology Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee and Audit Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full board of directors at least quarterly.


text: Cybersecurity Risk Management and Strategy Our information technology ("IT") and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to customers and maintain stakeholder trust. Our Vice President of Information Technology ("VP IT") is responsible for establishing, implementing, and executing our cybersecurity program and strategy. Our VP IT has more than 25 years of IT, IT audit, and cybersecurity experience, and is involved in assessing the latest developments in cybersecurity, including potential threats and innovative risk management techniques. All IT staff are obliged to include cybersecurity as part of their everyday considerations and tasks.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.


text: Our IT department proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: A formal enterprise-wide cybersecurity policy and related standards; Cybersecurity training and employee phishing simulations; Ongoing vulnerability assessment, identification, and remediation; Cyber incident response, IT disaster recovery, and business continuity plans; Identity and access management controls; Automated patch management and security updates; Network isolation of key operations environments; and Email filtering with attachment inspection and targeted threat protection.


text: The standards set in our cybersecurity program include the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. These standards are guided, in part, by the relevant National Institute of Standards and Technology (NIST) and American Water Works Association (AWWA) frameworks and guidance. We use various tools, security measures and technologies to aid in seeking to protect our network perimeter and internal systems from unauthorized access, intrusion, or disruption. Assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities.


text: We have policies and procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including monitoring compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants and related communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. In addition, a monitoring and detection system has been implemented to help identify cybersecurity threats and incidents. Our cybersecurity program also focuses on providing training and awareness to our employees and contractors on cybersecurity best practices.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Audit Committee receives an update from our VP IT and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our VP IT and our third-party cybersecurity consultant to review our cybersecurity strategy. In accordance with our cybersecurity incident response plan, our Board of Directors is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect the company, see the risk factor titled "Our business could be adversely affected by cyber threats or other interruptions to information technology, communications networks and operations." in Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party consultants, designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues timely.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: As new threats to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our IT Director.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and IT Steering Committee each having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement. In addition to its other responsibilities, the IT Steering Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.


text: The IT Steering Committee and/or the full Executive Team receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Executive Team.


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors " above.


text: As discussed earlier under General Risk Factors, we have become increasingly dependent upon technology, including information systems as well as infrastructure and cloud applications and services. These technologies are used to operate our businesses, process and record financial and operating data, communicate with our business partners, analyze mining information, estimate quantities of coal reserves, and perform other activities related to our business.

companyName: Ramaco Resources, Inc.

ticker: METC


text: Ramaco uses third parties to manage its information technology ("IT") infrastructure. The Company's process for assessing, identifying, and managing material cybersecurity risks includes the following activities, all of which are performed or assisted by third parties with considerable experience providing managed IT and security services or IT assurance services:


text: Assessment of cybersecurity risks, using the National Institute of Standards and Technology Cybersecurity Framework as a guide, as part of the overall IT risk assessment performed annually; Network operations center monitoring to establish baseline metrics and assist with anomaly detection; Periodic vulnerability scanning; Configuration of firewall, antivirus, and malware protection as well as alert thresholds; Generation of system audit logs and recovery backups; Preparation of an incident response plan and assignment of team members;


text: Logical access security reviews for applications and data protection; and Awareness training for employees on cybersecurity threats and safe practices.


text: The Company also uses applications hosted by a reputable third party that are critical to managing Ramaco's business and financial records. The process to oversee and identify cyber risks associated with the third-party service provider involves reviewing its annual System and Organization Controls 2 ("SOC 2"), Type 2 Report as well as conducting recurring status meetings with the third party.


text: The responsibility for managing and assessing material risks from cybersecurity threats lies with the Company's IT Steering Committee, which met five times during 2024. The IT Steering Committee is made up of five members of senior management having legal or corporate finance backgrounds. The committee also includes one lead representative of the third-party IT management and security service providers utilized by the Company to mitigate cybersecurity risks as discussed above. Information regarding cybersecurity risks and mitigation efforts is reported periodically by the IT Steering Committee to the Company's chief executive officer, chief financial officer, and Audit Committee. The Audit Committee is primarily responsible for the Board of Directors ' oversight of cybersecurity risks. The Company created and hired a new role in early 2025, Vice President of Information Technology and Cybersecurity, which is expected to enhance the management and oversight of cybersecurity.


text: We have not experienced any cybersecurity incidents to date that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, and we may not be successful in preventing or mitigating a cybersecurity incident despite our efforts to protect against such risks. A successful cyberattack could lead to theft of sensitive information, ransomware, destruction of data, or other issues causing financial, legal, or reputational damage. These events are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, should they occur.


text: Risk Management and Strategy Our cybersecurity risk management program, a critical component of our overall enterprise risk management program, is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, Center for Internet Security Controls, regulatory guidance, and other industry standards. These frameworks provide a risk-based model for organizations to identify and manage cyber risks inherent to their business model.

companyName: SIERRA BANCORP

ticker: BSRR


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Using people, processes, and technology, we employ a variety of preventative and detective tools designed to monitor, alert, contain, and/or block suspicious activity. We design and implement controls designed to mitigate cyber risk, including ongoing education and training for employees and customers, preparedness simulations and tabletop exercises, and recovery and resilience tests. We actively monitor email for malicious phishing email campaigns and monitor remote connections. Additionally, we maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers.


text: Our Incident Response Plan, coordinated through the Senior Information Security Officer, provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation. The Incident Response Plan includes key members of executive and senior leadership, facilitates coordination across multiple parts of our organization, and is evaluated regularly.


text: We perform regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists, and engage independent auditors to periodically review our cybersecurity program, including our process, systems, and control effectiveness, and provide recommendations to continuously strengthen our program. Additionally, management conducts both bottom-up and top-down enterprise risk assessments, which include cyber security risk, and continuously monitors industry and government threat intelligence to identify emerging risks and ensure continued program effectiveness.


text: The Senior Information Security Officer (ISO), along with both the Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program. The Director of IT and Director of Information Services report to the Chief Financial Officer and are responsible for designing and maintaining the company's network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence. The ISO reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities. The ISO is responsible for the development and management of our information security program, which includes cybersecurity risk assessments, incident response, third-party risk management, and testing of first line activities.


text: Our Board of Directors and Board Risk Committee have delegated oversight authority to a management-level Risk Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise. The Risk Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience. The ISO and Director of IT present Information Security and Information Technology reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats. This information is subsequently reported up to the Board Risk Committee.


text: The Board Risk Committee is responsible for oversight of the Company's enterprise risk management program, which encompasses information technology, information security and cybersecurity. This includes management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Board Risk Committee also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs. Annual independent assessments of the Company's cybersecurity program which are completed by external parties with the required expertise are also presented to the Board Risk Committee. The Chief Risk Officer and ISO report to the Board and/or Board Risk Committee on cybersecurity risks. Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Financial Officer and/or the Chief Risk Officer, who will share these with the Company's Executive Officers and Board members, as appropriate.


text: Integrated Risk Management Our cybersecurity risk management program is an important component of, and is integrated into, our overall risk management process. Our Board, acting primarily through the Audit Committee, actively oversees the strategic direction, objectives and effectiveness of our risk management practices, including cybersecurity risk management, while management is responsible for the day-to-day management of the Company's risk exposure, subject to the direction and objectives established by our Board. As an important component of our risk management process, management reviews risks from cybersecurity threats and our programs for evaluating, mitigating and educating its employees regarding cybersecurity risks. The program includes a comprehensive set of security policies and procedures, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessments and penetration testing, to update our ongoing cybersecurity risk identification and mitigation efforts.

companyName: Liquidia Corp

ticker: LQDA


text: We have also implemented a well-established incident response plan to address cybersecurity threats and incidents related to operational risk, intellectual property theft, reputational risks, fraud and extortion, harm to the personal identifying data of employees or customers, violations of laws, and other risks, including procedures for (i) detection and analysis, (ii) containment and eradication, (iii) remediation and (iv) preparation for future incidents. These processes are aligned with standard industry frameworks, such as the National Institute of Standards and Technology, Committee of Sponsoring Organizations and International Organization for Standardization 27001, and other industry standards.


text: Engagement of Third-party Support To further improve the effectiveness of our cybersecurity risk management program, we engage third-party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of cybersecurity controls.


text: Third-party Risk Management We also implement third-party risk assessments to identify, assess and monitor material risks from cybersecurity threats associated with the use of any third-party vendor who interacts with our technology infrastructure or our confidential, proprietary, or personal information, or is otherwise part of our supply chain. These assessments include identifying and evaluating cybersecurity risks as part of the due diligence conducted prior to the selection of third-party service providers, recurring risk assessments to ensure such third-party vendors have acceptable levels of cybersecurity controls in place and ongoing monitoring to address material cybersecurity risks that may arise from such third-party relationships.


text: Impact of Risks from Cybersecurity Threats We do not believe that any of the risks from cybersecurity threats we have faced to date have materially affected, or currently viewed as reasonably likely to materially affect, the Company, our business strategy, results of operations or financial condition. However, the scope and impact of any future cybersecurity threats cannot be predicted and there can be no assurance that our cybersecurity risk management program will be effective in preventing material cybersecurity threats in the future. For a description of the risks from cybersecurity threats that may materially affect us, including our results of operations and financial condition, see Item 1A. Risk Factors – We are subject to information technology systems failures, security breaches, loss or leakage of data, technological malfunctions or other disruptions, which could result in, among other things, material disruption of our product development programs, financial losses, the inability to process transactions, the unauthorized release of confidential information and reputational risk, restrictions on accessing critical information and potential exposure to liability, all of which would negatively impact our business, financial condition or results of operations.


text: Board Oversight of Cybersecurity Threats The Board has oversight responsibility for the Company's overall risk management framework. The Board, acting primarily through the Audit Committee, is also responsible for oversight of our risk management practices, including as to cybersecurity, while management is responsible for the day-to-day risk management processes. Through our CEO and other members of management, the Board receives periodic reports regarding the risks facing the Company, including as to cybersecurity risks. In addition, the Audit Committee assists the Board in its oversight role by receiving regular reports from management regarding risks associated with technology, information systems and controls and security, including risks related to data security, cybersecurity and data privacy and the effectiveness of the Company's security controls, systems and policies.


text: Role of Management Our management and information technology teams, collectively, have decades of experience in the areas of information technology, finance, legal, human resources, data privacy and risk management. Our internal information technology organization, overseen by our Controller, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The day-to-day activities of our information technology organization are managed by our current head of information technology, who has more than 30 years of experience in information technology systems and cybersecurity, including experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure, and holds multiple industry-recognized certifications. The information technology organization also engages legal and cybersecurity professionals with appropriate subject matter expertise in support of its cybersecurity efforts. The information technology organization manages and continually enhances our enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur.


text: Incident responses under our cybersecurity incident response plan are led by our incident response team, consisting of our Chief Executive Officer (the "CEO"), Chief Financial Officer (the "CFO"), General Counsel, head of information technology and head of human resources, and supported by Legal, Compliance and other functions as appropriate. The incident response team, in connection with outside legal and cybersecurity advisors, is responsible for investigating suspected cybersecurity incidents, taking appropriate steps to contain, mitigate or resolve a cybersecurity incident and reporting findings to management. In the event of a cybersecurity incident, our General Counsel is responsible for convening a materiality incident response team to assess the materiality of cybersecurity incidents meeting certain escalation criteria. Through ongoing communications with the incident response team, management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity initiatives. Management provides regular updates to the Audit Committee and the Board concerning the Company's technology and cybersecurity programs, associated risks and our efforts to help mitigate those risks.


text: Risk Management and Strategy The Company has developed and maintained a comprehensive cybersecurity program which is integrated within the Company's enterprise risk management program and encompasses the corporate and operational technology environments, as well as client-facing products and services. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity incidents and risks within an ever-changing threat landscape. We utilize cybersecurity policies and frameworks based on industry and government standards, including the National Institute of Standards and Technology Cyber Security Framework (" NIST CSF "). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Our cybersecurity program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incident. The Company operates a 24 x 7 security operations center (" SOC ") which monitors our global cybersecurity solutions and production environments, and serves as a central location for the reporting of cybersecurity matters. The roles and responsibilities of the SOC and our cybersecurity team in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation.


text: We partner with third parties to support and evaluate our cybersecurity program. The Services provided by third-parties span areas including cybersecurity maturity assessments, incident response, penetration testing and consulting on best practices. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our data or our systems. Third-party risks are included within our risk assessment of vendors, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We also implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We communicate these and other pertinent security issues or compliance changes through our regular internal communications cadence. Additionally, the Company has mandatory security awareness training addressing cybersecurity, privacy and confidential information.


text: In 2024 and 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In June 2022, ETI experienced a previously disclosed network security incident which had material adverse impact and required ETI to, among other things, limit access to its applications and services by its employees and customers. In response, ETI incurred considerable costs to restore the security of its internal systems and networks and adopted various enhancements. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. Please refer to " Item 1A. Risk Factors " for further information about the material risks associated with various cybersecurity threats.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management and compliance programs.


text: Our cybersecurity program is led by our Chief Technology Officer (" CTO "), who has two decades of experience in various cybersecurity, software development, product management, and other technology-related roles. Our CTO oversees teams across the company supporting our security functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions.


text: Our Audit Committee receives periodic reports from our CTO and management on our cybersecurity risks and the current threat landscape trends. In addition, management will update the Board directly, as necessary, regarding cybersecurity incidents. The full Board also receives presentations on cybersecurity topics from our CTO and other security management staff as part of the Board's continuing education on topics that impact the Company.


text: The Company's information security program is designed with the goal of maintaining the safety and security of its systems and data. The risk management program is designed to identify, assess, and mitigate risks across various aspects of the company, including financial, operational, regulatory, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. With the departure of the Company's Chief Information Officer during the first half of 2023, the Company has engaged a third-party cybersecurity expert to assess the security of the Company's systems and networks. In addition, the Company engaged a third-party vendor, along with an in-house system administrator, together the "IT Management", to service the Company's information systems.

companyName: ATEL 16, LLC


text: The objective in managing cybersecurity risk is to avoid or minimize the impact of efforts to penetrate, disrupt or misuse Company systems or information. Cybersecurity helps to maintain an environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, and privacy. IT Management is charged with cybersecurity and uses a layered approach to protect systems with ESET and Cylance.


text: IT Management uses a risk-based framework core consisting of cybersecurity activities, outcomes, and references that provide guidance for developing individual organizational profiles. IT Management is tasked with and shall:


text: Prioritize and scope. Identify organization objectives and priorities and determine the scope of systems and assets that support the selected business line or process.


text: Orient. Identify Information Systems and assets, regulatory requirements, and overall risk approach, identify threats to, and vulnerabilities of, those systems and assets. Risk assessment. Identify the likelihood of a cybersecurity event and the impact on the organization. Consider emerging risks. Target Profile. Create a Target Profile focusing on categories, subcategories, and desired cybersecurity outcomes.


text: Determine, Analyze, and Prioritize Gaps. Compare the Current Profile and the Target Profile to determine gaps and create a prioritized action plan to address those gaps. Implement Action Plan. Determine actions to take and monitor against the Target Profile.


text: Individual consent to the use of personal information Collecting the minimum amount of personal information Controls over the use and disclosure of personal information Use and retention of personal information related to a cybersecurity incident Transparency for certain cybersecurity activities


text: Accountability and auditing IT Management ensures that the Company's risks are properly monitored, managed and mitigated to the extent possible; and oversees the implementation and maintenance of formal strategies that govern information resources.


text: In addition, the Company has established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists.


text: The Company also leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program. The Chief Operating Officer manages the Company's IT and cybersecurity environment, which is reviewed at least semi-annually.


companyName: ATEL 17, LLC


text: The Company maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the Company's overall risk management processes, which are overseen by the Board of Directors.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: Risk Management and Strategy The Company's Enterprise Risk Management Policy assists the Board of Directors and management in clarifying their tolerance for identifying those credit, market, liquidity, operational, legal, compliance, strategic, reputation and security (information and physical) risks that have the potential to cause material financial harm to the institution, as well as describing a methodology for determining the proper level of controls to manage and mitigate those risks. Cybersecurity is a critical component of risk management, given the increasing reliance on technology and the increasing cybersecurity threat landscape. The Information Security Program is built on the Federal Financial Institutions Examination Council (FFIEC) IT Handbooks, National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Center for Internet Security (CIS) Cybersecurity Controls (CSC), and industry best practice. The Information Security Program utilizes a defense in depth strategy that leverages multiple security measures to protect Company assets and information.


text: The Board of Directors is responsible for overseeing management's development and execution of the Company's risk management process. Risk management is administered by a senior management team called the Management Enterprise Risk Committee (MERC). Periodic risk assessments are performed to identify technical and physical risks to information systems. These risk assessments identify internal and external threats that could cause a cybersecurity incident, assessing the likelihood of potential impact of those threats, and assessing the measures and controls in place to manage the risks. As per FFIEC guidance, a Change Management Policy and Committee are in place to manage changes to technology and systems. Information Security is a member of this Committee to evaluate changes for information security impact.


text: The Company leverages internal and external auditors to periodically review information technology and information security policy, processes, and controls to ensure they meet regulatory compliance and operate effectively. Independent penetration testing is performed annually.


text: The Company maintains an Incident Response Plan and a Crisis Communication Plan that provide documented guidelines for handling potential threats and taking appropriate measures including timely notification of cybersecurity threats and incidents to senior management and the Board of Directors when appropriate. The Incident Response Plan is managed by the Chief Information Security Officer (CISO) and is reviewed and tested at least annually. The Crisis Communication Plan, managed by the Director of Marketing and Alternative Delivery, is reviewed and tested at least annually.


text: The Company uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing and vulnerability assessment. The Management Enterprise Risk Committee has established risk management guidelines for third-party vendors. Through the Vendor Management Committee, the Company conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, the Company's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed periodically. The Company cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, the Company may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that the Company shares with such providers.


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, the Company has not detected any material cybersecurity incident to our own systems. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, or financial condition.


text: The Company's information technology resources are managed by the Information Technology Department, which is responsible for the first line of defense – identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (CIO), who reports to the Company's President and CEO. The present CIO has been employed by the Company in the information technology area for three years and was previously the CISO at the Company for two years. The present CIO has over 36 years of IT experience, 13 of that in banking. The CIO holds a current Certified Information Systems Security Professional (CISSP) designation.


text: The Chief Information Security Officer (CISO) whose responsibilities constitute the second line of defense provides the vision, leadership, and strategies necessary to protect the information security of the Company. The CISO manages policy, procedure, and process to ensure the execution of the Company's Information Security and Business Continuity/ Disaster Recovery (BC/DR) Programs. The CISO reports directly to the Chief Risk Officer to provide segregation between the first and second line of defense. The Information Security Department, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Company's information systems, and monitors implemented security measures. The CISO has over 30 years of IT and IT security experience in various organizations with 14 years in the banking industry.


text: The Company has established a Management Technology Committee and a Board Technology Committee. These Committees provide oversight and governance of information technology and the Information Security Program and meet quarterly. The Board Technology Committee's responsibilities include: (1) monitoring the strategic deployment and usage of Information Technology throughout the Company using reports and presentations from management;


text: (2) oversight of cybersecurity preparedness through information security reports, discussion of internal events and discussion of cybersecurity topics pertinent to the Company and the industry; (3) oversight of activities in support of the Company's business continuity/disaster recovery program to ensure optimal corporate resiliency in the unlikely event of a disaster; and (4) providing broad strategic guidance on the technology direction of the Company by, among other things, overseeing the development of the AmeriServ Strategic Technology Plan.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under NIST.

companyName: DISH DBS CORP


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and EchoStar's Board of Directors as a whole to ensure accountability.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, cybersecurity maturity assessments, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future.


text: We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: The Chief Information Security Officer ("CISO") leads our information security organization responsible for overseeing our information security program. The CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, EchoStar's Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.


text: We anticipate that we will continue to evaluate and address as needed our cybersecurity risk management, policies, structure, strategies and governance to meet our needs.


text: With oversight from the Board of Trustees, the Advisor is responsible for managing all cyber risks and overseeing our security programs. Cybersecurity risk management has been delegated to the Advisor's executive officers, with day-to-day management carried out by the Advisor's Chief Financial Officer (CFO), Elizabeth Reich.

companyName: Sterling Real Estate Trust


text: The Advisor 's cybersecurity risk oversight includes: (i) reviewing and approving technology security policies and internal cybersecurity controls, (ii) monitoring cybersecurity and information security exposures, (iii) confirming the Advisor has adequate procedures in place to not only control and limit these exposures but also to timely respond to any cyber incident, and (iv) mandatory cyber security trainings for all Advisor personnel.


text: The Advisor partners with several third-party technology providers to monitor and protect internal IT infrastructure and data. The Advisor has hired Marco Technologies as the organization's Managed IT provider with tools that systematically update hardware and software while also monitoring uptime to ensure seamless business operations. Marco Technologies also provides cyber security trainings, which all Advisor personnel are required to complete on a monthly basis. The Advisor utilizes Red Canary to provide 24/7 monitoring on all end points with triggers to isolate and mitigate any suspicious cyber activity. Finally, High Point Networks provides physical and cloud-based network data backup solutions for the Advisor. In collaboration with the Advisor, an extensive data back-up plan is in place with Return to Operations objectives of less than 24 hours. Although our CFO does not come from an information technology background, she relies on her extensive organization and project management experience to coordinate and manage the third-party providers who perform our cybersecurity function and to implement our cybersecurity incident response plan described below.


text: The Board of Trustees and Advisor are aware that preventive measures cannot prevent all cyber incidents. When a cyber incident occurs, our actions are guided by an incident response plan decision tree to (i) detect, contain and eradicate any threats, (ii) assess materiality, (iii) notify internal parties, (iv) recover any compromised data and information systems, (v) limit impacts of any such incident on the Trust's operations, and (vi) report any such incident as required by law or as otherwise necessary.


text: Our business strategy, results of operations or financial condition have not been materially impacted by cybersecurity threats, including as a result of any previous cybersecurity incidents. Although we cannot predict the cybersecurity incidents we may face in the future, we believe we have implemented reasonable cybersecurity protections and do not have reason to believe our business strategy, results of operations or financial condition will be materially impacted by cybersecurity incidents in the future. For a discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."


text: Cybersecurity Risk Management and Strategy At Century Therapeutics, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of Company information. We have implemented a cybersecurity program in accordance with our risk profile and business that is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Our cybersecurity risk management program includes multiple components, including information security maturity assessments, penetration testing, and vulnerability assessments, that are conducted periodically by both internal and external resources. We also conduct employee training and leverage third-party security tools, including but not limited to access controls, threat monitoring, and endpoint protection and response. We maintain a security operations center operated by a third party that collects cybersecurity threat data from multiple internal and external sources and determines if activity is potentially suspicious or malicious. We are in the process of developing and implementing additional cybersecurity policies and procedures.


text: We take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on the nature of the data accessed by the vendor. Currently, we review System and Organization Controls ("SOC") reports from vendors who have access to financial reporting information, and we are in the process of developing additional vendor risk management policies and procedures.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors experienced threats and security incidents that could affect our information or systems. For more information, please see Section 1A. Risk Factors.