text: industry best practices throughout our cybersecurity program to the extent practicable for a company of our size and resources. New leadership is committed to improving our cybersecurity strategy, with the goal of enhancing controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program will be aligned with applicable industry standards and maintained by a third-party technology firm. The third-party firm has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, annual and ongoing security awareness advice for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools.


text: IT/ cybersecurity firm reports to our Chief Executive Officer ("CEO"). The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CEO reports directly to the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Board of Directors will occur at least annually, or more frequently as determined to be necessary or advisable.

companyName: BION ENVIRONMENTAL TECHNOLOGIES INC

ticker: BNET

secItem: Item 1C


text: Risk Management and Strategy Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board and our Audit Committee are actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks and applicable established industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures;


text: training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures;


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity third-party risk management process for service providers, suppliers, and vendors.


text: Notwithstanding the measures we have put in place internally and through third party industry experts, on October 15, 2025, we learned that a threat actor had gained unauthorized access to portions of our information technology ("IT") environment and claimed to have unlawfully accessed certain Company information and data. We immediately activated our cyber incident response plan to contain the intrusion, assess and investigate the incident and implement remedial measures. We also immediately notified law enforcement, including the Federal Bureau of Investigation (FBI), and retained external cybersecurity experts to assist. Based on our investigation to date, we believe that the cybersecurity incident consisted of unauthorized access and deployment of encryption and monitoring software by a third party to a portion of our internal corporate IT systems.


text: The incident caused disruptions and limitation of access to portions of our business applications supporting aspects of our operations and corporate functions, which we voluntarily took offline as a precautionary measure. Based on the information reviewed to date, we believe the unauthorized activity has been contained and we were able to bring the impacted portions of our IT systems and individual computer devices back online and operate at full capacity within a week of detection of the unauthorized access.


text: Although we ascertained that certain information was exfiltrated, we are still investigating the extent of compromise of any sensitive information contained within the accessed IT systems.


text: However, it is believed that the threat actors unlawfully accessed certain computer systems and exfiltrated images of video meetings and computer screens that may contain sensitive information. The threat actors released a portion of this information publicly and that of some of our vendors and customers since we had not acceded to their demand for a monetary payment. However, we do not believe that the threat actor was able to infiltrate the computer systems of any of our customers or vendors. We have taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access and bolstering our cyber defensive capabilities.


text: We believe that there will be additional costs associated with these activities but that the disruption to our operations and the costs associated with our cybersecurity experts will largely be covered by adequate insurance. However, there can be no assurance that our insurance carriers will accept liability under these policies, in which event, we would be compelled to pay the expenses of our cyber experts directly, which would increase our costs and have a material adverse effect on our future financial performance.


text: As the investigation of the incident is ongoing, the full scope, nature and ultimate impact of the incident are not yet completely known. We have no current evidence that any personally identifiable information of any employees, customers, suppliers or vendors has been compromised, but our analysis and review of the potential compromised systems and data is continuing.


text: Board is engaged in the oversight of cybersecurity threat risk management. Additionally, the Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Financial Officer. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: cybersecurity programs. Our expertise in IT and cybersecurity generally has been gained from a combination of education, best practices and prior experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above. As evidenced by the cybersecurity incident described above, no combination of defensive measures are infallible. However, we are confident that we have established robust and reasonable measures and defenses consistent with industry standards and our Company's operations and use of internet-related systems. While this landscape is continually changing, we attempt to be knowledgeable and flexible with regard to the protection of our data and that of our partners.


text: The Company recognizes the importance of cybersecurity and the potential risks associated with cyber incidents. As a small entity with simple operations managed solely by our Chief Executive Officer (CEO), we have not implemented formal cybersecurity policies or procedures. However, we take reasonable steps to protect our electronic data and ensure the security of our operations.

companyName: C & C TOURS, INC.


text: Given the size of our company and the nature of our operations, we believe the risk of significant cybersecurity incidents is minimal. Our CEO is responsible for overseeing all aspects of our business, including the management of cybersecurity risks. We utilize standard commercial software for business operations, which includes basic security features such as password protection and data encryption.


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. We will continue to monitor our cybersecurity risk profile and take appropriate actions to safeguard our data and systems.


text: Should any material cybersecurity incidents occur, we will assess the situation and disclose the nature, scope, and potential impact of the incident in accordance with SEC regulations.


companyName: CANCER CAPITAL CORP


companyName: PRESTIGE CAPITAL CORP


companyName: NOVA STAR INNOVATIONS INC


companyName: SKINOVATION PHARMACEUTICAL INC


text: store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Premier Air Charter Holdings Inc.

ticker: PREM


text: Cyber Risk Management and Strategy the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process.


text: third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We utilize well-known cloud-based technologies and service providers such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.


text: we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies. from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a)

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. The Company's Board of Directors as well as its Chief Technology Officer, Chief Information Security Officer, and Chief Financial Officer are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes, and practices for assessing, identifying, managing and mitigating material risks from cybersecurity threats.


text: rely on a multidisciplinary team, including our information security function, management, and third-party service providers to identify, assess, remediate and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, utilizing internal and external audits, and conducting threat and vulnerability assessments.


text: least annually, we review our security controls and address information security vulnerabilities, conduct security testing, and assess our external sources for their security risk (e.g., security incidents, data security, security controls, third parties, etc.). The results of the assessment are used to drive alignment and prioritization of initiatives to enhance our security posture, improve security processes, and to manage a broader enterprise-level risk program that is presented to the Board of Directors, the Audit Committee, and members of management.


text: Company maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats against our information systems and data. These include: incident detection and response management controls within our accounting and financial reporting functions security controls security management risk management program training.


text: the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. Refer to Item 1A for a discussion of cybersecurity risks.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee specifically assists the Board of Directors in its oversight of risks related to cybersecurity.


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: AMAZE HOLDINGS, INC.

ticker: AMZE


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Information Technology or IT department assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program.

companyName: Semler Scientific, Inc.


text: All employees receive cybersecurity training with job-specific topic considerations. Our IT team engages third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. The employees within our broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. Refer to the risk factor captioned " An information security incident, including a cybersecurity breach, could have a negative impact on our business or reputation" in Part I, Item 1A. "General Risk Factors" for additional description of cybersecurity risks and potential related impacts on our company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The audit committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short, intermediate, and long-term timeframe. Audit committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the chief financial officer on our enterprise risk profile on an annual basis. The audit committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our chief technology officer, or CTO, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current CTO has over 30 years of experience in information technology and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CTO provides periodic updates on our cybersecurity risk profile to management and the audit committee of our board of directors.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Information Technology or IT, department assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The audit committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short, intermediate, and long-term timeframe. Audit committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the chief technology officer or CTO on our enterprise risk profile on an annual basis. The audit committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our CTO is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current CTO has over 30 years of experience in information technology and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CTO provides periodic updates on our cybersecurity risk profile to management and the audit committee of our board of directors.


text: As a global leader in animal health, we are reliant on complex information systems and digital solutions that make us inherently vulnerable to malicious cyber intrusion and attack. In addition, we have been expanding our data and digital capabilities including in our diagnostics portfolio, and as a result, there could be an increased likelihood of a cyberattack or breach of security that could negatively impact us or our customers. Despite the presence of these risks, to date, the identified risks of cybersecurity threats (including as a result of any previous cybersecurity incidents) have not materially affected, and are not reasonably likely to materially affect, us or our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: Zoetis Inc.

ticker: ZTS


text: Cybersecurity Program As part of our risk management processes, we have an enterprise-wide cybersecurity program aligned to the NIST Cybersecurity Framework. Our program is a risk-based program designed to protect our information systems through multiple defenses and layers of security, commonly referred to as a "Defense in Depth" approach. Key elements of our program include:


text: Independent Third-Party Assessments We engage an independent third party to conduct assessments of our cybersecurity program approximately every 18 months. This independent third-party assessment includes an evaluation of our cybersecurity controls based on the NIST Cybersecurity Framework.


text: We have an information security training program that includes: monthly awareness articles, a phishing training program (with reports reviewed by the Executive Team), a Security Ambassador program for additional training and awareness for individuals in high risk roles, required and optional training modules in our Learning Management System, and quarterly security-focused podcasts.


text: Incident Response Procedure We have a 24/7 managed Security Operations Center (SOC) for escalation of any critical events, including cybersecurity incidents. In the event of an incident, we use an Incident Response procedure leveraging NIST Standard 800-61 standards that we have customized for Zoetis. Additionally, we have in place disaster recovery and business continuity practices designed to provide for continuous business operations for our customers in the event of a cybersecurity incident. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Third Party Onboarding We depend on third parties and applications on virtualized (cloud) infrastructure to operate and support our information systems and have a third-party risk management program and assessment process for onboarding third parties.


text: Management's Role in Risk Oversight Our information security team includes our Executive Vice President, Chief Digital & Technology Officer; our Vice President, Chief Information Officer; and our Head of Technology Risk, Compliance and Chief Information Security Officer. Our Executive Vice President, Chief Digital and Technology Officer has over 20 years of information technology experience. She was the Chief Information Officer for key business units at an S&P 500 healthcare company, and was that company's first Chief Information Security Officer, where she led the strategy and execution to secure products, devices, manufacturing systems and information across businesses. She holds a master's degree in computer science and a master's degree in business applications of information and technology. Our Vice President, Chief Information Officer has over 20 years of experience in technology and digital leadership roles at large public companies and holds a bachelor's degree in information systems. Our Head of Technology Risk, Compliance and Chief Information Security Officer has over 20 years of experience in information security, and holds a bachelor's degrees in computer science and biology.


text: We have established a cybersecurity governance program with clear roles for the executive management team as well as oversight by the Board of Directors and the Audit Committee. The Zoetis information security team provides regular cyber threat intelligence briefings to management and provides updates to our senior executives on the status of the Company's security measures and our efforts to identify and mitigate risks from cybersecurity threats. The Zoetis information security team also works closely with the Zoetis Legal team, including the Chief Privacy Officer, to further enhance incident response procedures. For example, we have a corporate crisis management plan in place to govern our response to corporate crises, which could include cyber incidents, and we conduct periodic simulated programs to ensure readiness. This plan also includes a standard framework for categorization of incidents based on risk level and severity, and requires escalation to Zoetis senior management and/or the Audit Committee of the Board of Directors if certain severity levels are met.


text: Role of the Board of Directors and Committees The Board of Directors maintains an active role in the oversight of material risks. The Board of Directors utilizes its various Committees to oversee certain key risks, and has delegated responsibility to the Audit Committee for oversight of the Company's enterprise risk management process and information security risk management program. Management, with oversight from the Zoetis Board of Directors, is responsible for the Company's assessment and management of exposure to risk. The Audit Committee of the Board of Directors is also responsible for oversight of compliance with disclosure requirements under applicable laws and regulations, and would be consulted prior to the disclosure of any material cybersecurity incident.


text: The Zoetis information security team regularly provides an information security dashboard to the Audit Committee, covering the most active and relevant threats to Zoetis, relevant trends, and any notable events. At least twice annually, the Zoetis information security team presents updates to the Audit Committee with respect to the information security program, including the status of our security measures and our efforts to identify and mitigate information security risks. The Audit Committee also regularly reviews certain data privacy and cybersecurity metrics as part of the compliance update presented to the Audit Committee.


text: In addition, the Chief Information Security Officer presents updates at least annually to the Board of Directors with respect to the information security program, including the results of our independent, third-party assessment. The Board of Directors also participates in annual table-top exercises involving simulated data security incidents and the Company's responses to those incidents.


text: As a global leader in animal health, we are reliant on complex information systems and digital solutions that make us inherently vulnerable to malicious cyber intrusion and attack. In addition, we have expanded our data and digital capabilities including in our diagnostics portfolio, and as a result, there could be an increased likelihood of a cyberattack or breach of security that could negatively impact us or our customers. Despite the presence of these risks, to date, the identified risks of cybersecurity threats (including as a result of any previous cybersecurity incidents) have not materially affected, and are not reasonably likely to materially affect, us or our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Cybersecurity Program As part of our risk management processes, we have an enterprise-wide cybersecurity program aligned to the NIST Cybersecurity Framework (CSF). Our program is a risk-based program designed to protect our information systems through multiple defenses and layers of security, commonly referred to as a "Defense in Depth" approach. Key elements of our program include:


text: Independent Third-Party Assessments We engage an independent third party to conduct comprehensive assessments of our cybersecurity program approximately every 18 months. This independent third-party assessment includes an evaluation of our cybersecurity controls based on the CSF.


text: We have an information security training program that includes: monthly awareness articles, a phishing training program (with reports reviewed by the Executive Team), and required and optional training modules in our Learning Management System.


text: Management's Role in Risk Oversight Our information security team includes our Executive Vice President, Chief Digital & Technology Officer and our Head of Technology Risk, Compliance and Chief Information Security Officer. Our Executive Vice President, Chief Digital and Technology Officer has over 20 years of information technology experience. Prior to Zoetis, he was the VP, Information Technology at Biogen, overseeing all aspects of Infrastructure, IT Operations, and Enterprise Architecture globally and held various corporate leadership roles at Eli Lilly and Company, including Head of IT Infrastructure and Enabling Functions. He holds a bachelor's degree in information systems and a master of business administration degree. Our Head of Technology Risk, Compliance and Chief Information Security Officer has 37 years of experience in Life Sciences Information Technology, including over 20 years of experience in information security and holds bachelor's degrees in computer science and biology.


text: The Zoetis information security team regularly provides an information security dashboard to the Audit Committee, covering the most active and relevant threats to Zoetis, relevant trends, and any notable events. The Zoetis information security team regularly presents updates to the Audit Committee with respect to the information security program, including the status of our security measures and our efforts to identify and mitigate information security risks. The Audit Committee also regularly reviews certain data privacy and cybersecurity metrics as part of the compliance update presented to the Audit Committee.


text: Risk Management and Strategy We prioritize the management of cybersecurity risk and regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity program.

companyName: Rithm Capital Corp.

ticker: RITM


text: We use a combination of cyber security personnel, documented processes and purpose-driven technologies and monitoring systems to identify, protect, detect, respond and recover from security incidents. These encompass incident response procedures, information security and vendor management and a combination of participation in industry consortiums, continuous monitoring, internal, as well as independent testing of systems, and team member education. Our independent testing includes both (i) periodic testing and evaluations performed by our internal audit firm and (ii) annual network penetration testing conducted through independent third parties. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. As part of these processes, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business (including, but not limited to, SEC rules, the CCPA and the Gramm-Leach-Bliley Act, as further described under the caption "Business—Regulations"), as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: Additionally, in order to reduce cybersecurity risk related to the use of third-party service providers, we (i) obligate our service providers to adhere to privacy and cyber security measures and (ii) perform risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is then ranked in a tier, which tier determines the frequency and extent of evaluation for the service provider. We additionally collect SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents from each of our key service providers.


text: To date, cybersecurity risks, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We do not believe that cybersecurity risks resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect us. Refer to the risk factor captioned "Cybersecurity incidents and technology disruptions or failures could damage our business operations and reputation, increase our costs and subject us to potential liability" in Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our board of directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the board, in conjunction with the Mortgage and Regulatory Compliance Committee (the "MRC Committee"), which focuses on the risk structure and governance related to the Mortgage Company's mortgage servicing and origination business, oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframe. Audit Committee meetings and MRC Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") on the Company's enterprise risk profile and the Company's risk treatment policies and processes on a quarterly basis or as needed.


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the CISO is focused on assessing, managing, mitigating and reporting on cybersecurity threats and risks.


text: The CISO, in conjunction with the CIO, the Chief Risk Officer and the Chief Legal Officer, manages the Company's cyber security posture. The current CISO has more than 20 years of experience in information security and information technology, including previously serving as the CISO for multiple large multinational corporations. In addition to his extensive work experience, the CISO holds a Bachelor of Science in Business Administration with an emphasis on Management of Information Systems from Alliant University and a Master of Science in Business Administration with an emphasis on Information Systems Audit from California State Polytechnic University. The CISO has the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Fraud Examiner (CFE) and Federal Bureau of Investigations (FBI) CISO Academy Graduate. The CISO reports to the CIO and management on cybersecurity threats on a regular basis.


text: The CISO monitors the Company's cybersecurity posture through the Security Incident Response Team, which consists of key individuals in the legal, human resources, compliance, privacy, risk and information security departments across Rithm Capital and its operating companies. Any escalations will then be raised by the CISO and CIO to Company management who will work with the CISO and CIO to determine the appropriate remediation effort.


text: At the employee level, we maintain an experienced information technology team tasked with implementing our privacy and cybersecurity program and support the CISO in carrying out reporting, security and mitigation functions. We also hold employee trainings on privacy and cybersecurity, as well as records and information management, and we conduct phishing tests. We generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.


text: Risk Management and Strategy We prioritize the management of cybersecurity risk and regularly assess any risk of cybersecurity threats. In doing so, we continuously monitor and test our information systems for potential vulnerabilities pursuant to our cybersecurity program. Our cybersecurity program, led by our interim Chief Information Security Officer ("CISO"), is part of our overall enterprise risk management program, along with other significant risks that we face.


text: Our dedicated cybersecurity personnel supervise and monitor our controls, technologies, systems and other processes utilized to mitigate any data loss, theft, exploitation, unauthorized access or other vulnerabilities that may affect our information or data. Specifically, our cybersecurity program consists of incident response procedures, information security and vendor management due diligence, as well as participation in industry consortiums, ongoing monitoring, internal and independent testing of information systems and continuous employee education and simulations. Our independent testing includes both (i) periodic testing and evaluations performed by our internal audit team and (ii) annual network penetration testing conducted through independent third parties. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. As part of these processes, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business (including, but not limited to, SEC rules, the CCPA and the Gramm-Leach-Bliley Act, as further described under the caption "Business—Regulations"), as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.


text: Additionally, in order to reduce cybersecurity risks related to our use of third-party service providers, we (i) obligate our service providers to adhere to strict privacy and cybersecurity measures and (ii) perform risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is assigned a tiered risk rating, which determines the frequency and extent of evaluation for the service provider. Furthermore, we collect and evaluate SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents for our key service providers.


text: To date, cybersecurity risks, including those resulting from any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations or financial condition. We do not believe that cybersecurity risks resulting from any previous cybersecurity incidents, of which we are aware, are reasonably likely to materially affect us. Refer to the risk factor captioned "Cybersecurity incidents and technology disruptions or failures could damage our business operations and reputation, increase our costs and subject us to potential liability" in Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our board of directors oversees the Company's risk management program, including our cybersecurity program, both directly and through several committees created as part of our risk governance program. Specifically, the Audit Committee of the board, in conjunction with the Regulatory Committee (the "Regulatory Committee"), which focuses on the risk structure and governance related to regulatory risk throughout all lines of business, oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframe. Audit Committee meetings and Regulatory Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the CISO and Chief Information Officer ("CIO") on the Company's enterprise risk profile and the Company's risk treatment policies and processes on a quarterly basis or as needed. Additionally, we have protocols by which certain cybersecurity incidents are escalated in a timely manner to the Audit Committee and the board of directors.


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the CISO is focused on assessing, managing, mitigating and reporting on cybersecurity threats and risks and is tasked with overseeing and enhancing the security posture of the Company and it subsidiaries. This role involves prioritizing and implementing security initiatives across all organizational units. The CISO plays a critical role in protecting the Company's assets, data and reputation by developing a robust security strategy and security awareness. Our current CISO brings over 20 years of experience in IT operations and information security with a proven track record working in large financial institutions, mortgage companies and banks, with expertise in managing complex security environments. The CISO, in conjunction with other executive leaders such as the CIO and the Chief Legal Officer, manages the Company's cybersecurity posture.


text: In doing so, the CISO receives regular reports prepared by our experienced cybersecurity personnel on cybersecurity threats and continuously reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks.


text: Corporate Governance Our information security program is managed by a dedicated Vice President of Information Technology, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Vice President of Information Technology also provides quarterly reports to the Audit Committee of our Board of Directors (the "Audit Committee"). The Vice President of Information Technology also provides reports to our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the current threat landscape. Our program is regularly evaluated by internal and external experts, with the results of those reviews reported quarterly to the Audit Committee and senior management. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Thryv Holdings, Inc.

ticker: THRY


text: Risk Management and Strategy We have established processes and policies for assessing, identifying and remediating material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our processes are focused on: (i) effecting organizational education on how to manage cybersecurity risks, (ii) implementing safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident and (v) recovering from a cybersecurity incident. Additionally, we have a cybersecurity incident response plan including specific responsive protocols administered by an incident response team, led by our Vice President of Information Technology and comprised of other members of management.


text: As a part of our organizational education on risk management, we require that employees annually complete information and privacy training. We also administer employee awareness training around phishing, malware, and other cyber risks on an ad hoc basis as necessary to enhance our protection efforts. We actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. For example, our incident response team conducts periodic tabletop exercises with outside consultants to ensure adherence to our cybersecurity incident response plan. Additionally, we maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see "Risk Factors - An information security breach of our systems or our data centers operated by third-party providers, the loss of, or unauthorized access to, client information, or a system disruption could have a material adverse effect on our business, market brand, financial condition and results of operations."


text: Corporate Governance Our information security program is managed by a dedicated Vice President of Information Technology ("VP of IT"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The VP of IT has the relevant expertise in understanding risks from cybersecurity threats and has extensive experience managing cybersecurity risk management programs. Additionally, the VP of IT has served in various leadership roles in information technology and information security for over 20 years. The VP of IT provides quarterly reports to the Audit Committee as well as our Chief Executive Officer and other members of our senior management, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the current threat landscape. Our program is regularly evaluated by internal and external experts, with the results of those reviews reported quarterly to the Audit Committee and senior management. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Risk Management and Strategy We have established processes and policies for assessing, identifying and remediating material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology Cybersecurity Framework. Our processes are focused on: (i) effecting organizational education on how to manage cybersecurity risks, (ii) implementing safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident and (v) recovering from a cybersecurity incident. Additionally, we have a cybersecurity incident response plan including specific responsive protocols administered by an incident response team, led by our Vice President of Information Technology and comprised of other members of management.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see "Risk Factors - An information security breach of our systems or our data centers operated by third-party providers, the loss of, or unauthorized access to, client information, or a system disruption could have a material adverse effect on our business, market brand, financial condition and results of operations."


text: Cybersecurity Risk Management and Strategy We have developed and implemented an information security and cybersecurity risk management program ("Program") intended to protect and preserve the confidentiality, integrity and availability of our data and information technology systems. Our Program is integrated into our overall enterprise risk management program. We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a benchmark to ensure that our Program is maintained in line with industry best practices. This does not imply that we meet any particular technical standards, specifications or requirements, but it does mean that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The Company maintains a decentralized information technology infrastructure, where each of our business units utilizes a separate and distinct information technology system. This means that if any business unit's systems are compromised, there is significantly less risk that another business unit will be impacted by that event. This decentralized structure also allows our information security professionals embedded within an individual business unit to make quick, efficient decisions when changes or actions are needed and provides an additional safeguard for our data and systems.


text: risk assessments and penetration tests integrated within our overall risk management processes that are designed to identify cybersecurity and technology risks, as well as to formulate management actions to respond to, mitigate and remediate material issues (if any); annual management reporting to the Board of Directors (the "Board");


text: reporting of the scope, objectives and results of internal audits on the procedures performed on the control environment related to our information security systems and security controls to the Audit Committee at least two times a year;


text: annual cybersecurity awareness training to instruct employees how to better identify cybersecurity concerns and to avoid actions that might inadvertently allow outsiders to access our systems;


text: installation of end point protection software on our Company-managed systems and workstations in an effort to detect and prevent malicious code from impacting our systems; a cross-functional team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, monitor, test or otherwise assist with aspects of our security controls and response to cybersecurity incidents; and a documented framework and supporting processes for handling security incidents that facilitates coordination across multiple parts of the Company.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior security breach, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition and results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a discussion of certain risks related to cybersecurity, refer to the risk factor titled " Cybersecurity incidents affecting our information technology systems could disrupt business operations or cause the release of highly sensitive confidential or personal information, resulting in adverse impacts to our reputation and operating results and potentially leading to litigation and/or governmental investigations, fines and other penalties " in Part I, Item 1A. Risk Factors herein.


text: Cybersecurity Governance Our Board maintains oversight responsibility relating to our Program, with assistance from the Audit Committee. At least annually, our management team (including the leaders of our Information Technology and Internal Audit teams) provides an update regarding our Program to the Board. This update provides an overall assessment of the effectiveness of our Program and a review of areas of focus for the upcoming year. The Board also receives periodic reports from our Vice President, Internal Audit, on the audit focus areas and control testing related to our information security systems and security controls, and our management team updates the Board, as necessary, regarding any material cybersecurity incidents.


text: Our management team, including our Senior Vice President and Chief Financial Officer, Senior Vice President and General Counsel, Vice President, Information Technology, and Vice President, Internal Audit, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our Program and our Vice President, Information Technology, supervises both our internal information security personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel and external consultants engaged by us, as well as alerts and reports produced by security tools deployed in our information technology environment.


text: Our management team's experience includes knowledge related to information technology, cybersecurity and incidence response, risk management, control analysis and corporate governance. For additional details about our management team and their experience, refer to the Executive Leadership page on the Company's website at https://www.amphenol.com/governance/leadership.


text: The Company has no employees and is externally managed by our Manager, which is a wholly owned subsidiary of CTO, a publicly traded diversified REIT. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: As an externally managed company, the Company relies on CTO's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by CTO. All of the Company's executive officers are executive officers and employees of CTO, and one of the Company's officers (John P. Albright) is also a member of CTO's board of directors.


text: CTO's cybersecurity processes and practices are integrated into CTO's risk management and oversight program. In general, CTO seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that CTO collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. CTO utilizes a third-party managed IT service provider (the "MSP") to provide comprehensive cybersecurity services for the Company, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery, and cybersecurity education and awareness. The Company has adopted a written information security incident response plan, which, as discussed below, is overseen by the Audit Committee of the Board (the "Audit Committee").


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management will be supported by the Audit Committee, which regularly interacts with the Company's management team.


text: Collaborative Approach: CTO has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, the Audit Committee, and the Board in a timely manner.


text: Technical Safeguards: CTO and the MSP deploy technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention systems, endpoint detection and response systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: CTO and the MSP have established a written information security incident response plan that addresses the response to a cybersecurity incident, which plan will be tested and evaluated on a regular basis.


text: Third-Party Risk Management: CTO and the MSP maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of CTO's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: CTO, through the MSP, provides regular training for personnel regarding cybersecurity threats as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: CTO and the MSP will engage in the periodic assessment and testing of CTO's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts will include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of CTO's cybersecurity measures and planning. The MSP regularly assesses CTO's cybersecurity measures, including information security maturity, and regularly reviews CTO's information security control environment and operating effectiveness. The results of such assessments, audits and reviews will be reported to the Audit Committee and the Board, and CTO will adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, will oversee the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee must review and discuss with the Company's management team the Company's privacy and cybersecurity risk exposures, including: the potential impact of those exposures on the Company's business, financial results, operations and reputation; the steps management has taken to monitor and mitigate such exposures;


text: the Company's information governance policies and programs; and major legislative and regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure.


text: The charter of the Audit Committee also provides that the Audit Committee may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks and that the Audit Committee will regularly report to the Board the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Audit Committee deems appropriate.


text: As noted above, the Company relies on CTO's information systems and the MSP in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by CTO. All of the Company's executive officers are executive officers and employees of CTO, and one of the Company's officers (John P. Albright) is also a member of CTO's board of directors.


text: CTO's President and Chief Executive Officer, Senior Vice President, Chief Financial Officer and Treasurer, and Senior Vice President, General Counsel and Corporate Secretary work collaboratively with the MSP to implement a program designed to protect CTO's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with written information security incident response plans adopted by CTO and the Company. These members of CTO's management team, together with the MSP, will monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.


text: CTO's President and Chief Executive Officer, Senior Vice President, Chief Financial Officer and Treasurer, and Senior Vice President, General Counsel and Corporate Secretary each hold degrees in their respective fields, and have an average of over 20 years of experience managing risks at CTO, the Company and similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: While we have never had a material cybersecurity incident that impacted our operations, we face various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; employee threats; virtual and cyber threats to our directors, officers, and employees; threats to the security of our facilities and infrastructure; and threats from terrorist acts or other acts of aggression. Our customers and vendors face similar threats. We utilize internal and external independent controls to monitor and mitigate the risk of these threats, including an outside independent Cybersecurity consultant, a Security Incident Response Plan (SIRP) and periodic Information Technology training for all employees.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: Preparation—perform a risk assessment, identify sensitive assets, and build a Computer Security Incident Response Team (CSIRT). Our team includes an outside IT Cybersecurity consultant that provides managed services on a regular basis.


text: Identification—monitor IT systems and detect deviations from normal operations and see if they represent actual security incidents. When an incident is discovered, collect additional evidence, establish its type and severity, and document everything.


text: Containment—perform short-term containment, for example by isolating the network segment that is under attack. Then focus on long-term containment, which involves temporary fixes to allow systems to be used in production, while rebuilding clean systems.


text: Eradication—remove malware from all affected systems, identify the root cause of the attack, and take action to prevent similar attacks in the future.


text: Recovery—bring affected production systems back online carefully, to prevent additional attacks. Test, verify and monitor affected systems to ensure they are back to normal activity.


text: Lessons learned—no later than two weeks from the end of the incident, perform a retrospective of the incident. Prepare complete documentation of the incident, investigate the incident further, understand what was done to contain it and whether anything in the incident response process could be improved.


text: The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts.


text: Effective incident response involves every part of our organization, including IT teams, legal, technical support, human resources, corporate communications, and business operations. Our Board of Directors oversees all business, property and affairs of the Company, including cybersecurity risks. Our management keep the members of the Board informed of our business through discussions at Board meetings and by providing them with reports and other materials throughout the year.


text: Our CSIRT includes our independent outside cybersecurity consultant as our strategic lead and the consultant and Chief Financial Officer (CFO) lead the Incident Response Team. Our consultant is certified in cybersecurity and our CFO has overseen our IT for over twenty years.


text: Risk management and strategy We rely on our information technology to operate our business and provide our Barostim Therapy to patients. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: CVRx, Inc.

ticker: CVRX


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication and recovery plans in the event of a cybersecurity threat or incident.


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We are also engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all third-party providers to ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Our Board of Directors recently assigned specific oversight responsibility for cybersecurity to our Audit Committee, which also oversees our general risk management. The Audit Committee reviews and discusses with management our policies, practices and risks related to information security and cybersecurity.


text: Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. Leaders of our information technology and device engineering, together with members of our finance team, comprise our Cybersecurity Committee, which meets to assess cybersecurity risks and identify new risks and assess our risk management framework on a quarterly basis. Among the members of this committee are employees who are knowledgeable about our products and systems, have prior experience managing cybersecurity risks, and maintain an active Certified Information Systems Security Professional certification.


text: Our chief financial officer provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.


text: Cybersecurity is an integral part of risk management at Nabors. We rely on our technology infrastructure and information systems to interact with clients, vendors, operate our drilling rigs, and bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed systems and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, theft of intellectual property or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors, organized crime and hackers with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence and machine-learning technologies.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: The Board of Directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, mitigation, and preparedness for recovery of any such incidents whether perpetrated on the Company or our stakeholders. The Risk Oversight Committee of our Board has direct oversight of our management of cybersecurity risks.


text: Our Enterprise Risk Management Committee receives reports on the Company's cybersecurity program and developments from our Vice President of Information Technology and reports to the Company's Board of Directors at each of the regularly scheduled quarterly meetings. These reports include analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status;


text: We have a cross-functional approach to addressing cybersecurity risk, with digital technology, legal, and the corporate audit functions presenting to the Enterprise Risk Management Committee on key cybersecurity topics; and On at least an annual basis, the full Board of Directors receives a comprehensive cybersecurity review, including director education from third-party cybersecurity experts.


text: Our Vice President of Information Technology, reporting to our Chief Administrative Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Risk Oversight Committee and the Board of Directors. Our Vice President of Information Technology has over 20 years of experience in the cybersecurity field, including with implementing advanced cybersecurity and risk management strategies, audits, compliance with regulatory requirements and applying various security frameworks such as ISO 27001 and NIST. Our Senior Director of Cybersecurity reports to our Vice President of Information Technology and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Senior Director of Cybersecurity has over 10 years of experience in the cybersecurity field including experience with risk assessments, implementing of industry-leading security tools, conducting security reviews of system implementations and cyber risk management strategies.


text: The Technology and Safety Committee of the Board of Directors reviews the integrity of information technology systems, including the potential for cybersecurity threats. In addition, the Risk Oversight Committee monitors management's identification and evaluation of major strategic, operational, regulatory, information technology, cyber security and other external risks inherent in the Company's business. Activities include mandatory training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. The Enterprise Incident Response Team also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Enterprise Incident Response Team escalates events, including to the Chief Executive Officer and Board of Directors, as relevant, according to pre-defined criteria.


text: We leverage the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to drive strategic direction and maturity improvement and engage third-party security experts to conduct risk assessments and program enhancements. Additionally, we evaluate our controls environment annually using other relevant standards like Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model.


text: We engage subject matter experts such as consultants to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Enterprise Incident Response Team oversees and establishes the parameters of our engagement with these experts to ensure we obtain the supplement assistance needed in this area, if any. See Part I, Item 1A.—Risk Factors— Our business is subject to cybersecurity risks.


text: Risk Management and Strategy The company continuously monitors its information systems to assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. The company's process for identifying and assessing material risks from cybersecurity threats operates alongside the company's broader overall risk assessment process. The company monitors risks through active (e.g., penetration tests and vulnerability scans) and passive (e.g., end-point protection) methods and addresses system alerts on a constant basis. The company's cybersecurity team immediately investigates system alerts that may indicate the presence of a cybersecurity threat or incident and escalates information regarding the threat or incident as necessary to address it in a timely manner. The company also maintains an incident response plan, which sets forth processes the company will follow to address a significant cybersecurity threat or incident. The incident response plan, among other things, provides for inter-departmental coordination and management of cybersecurity threats or incidents to quickly assess the impact, mitigate risks to information systems, and work to resolve vulnerabilities. Depending on the threat or incident, the company may utilize third-parties under retainer for assistance in investigating and addressing cybersecurity incidents or threats.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: Senior security leadership meets regularly with the company's risk-management team and internal and external auditors to evaluate the effectiveness of the company's systems, controls, and management processes with respect to cybersecurity risks. The company also engages third-party cybersecurity experts to assess its processes and suggest improvements, which are reviewed with the company's executive leadership.


text: The company also maintains procedures for screening and evaluating third-party providers prior to granting access to the company's information systems. The company assesses each such prospective supplier's system security in light of the product or service to be provided to the company. The security team analyzes high-value or high-risk third-party suppliers through interviews and surveys prior to engagement. Additionally, the company reviews third-party suppliers on an ongoing basis post-engagement to identify any changes in their security risk profile, including the occurrence of cybersecurity events affecting such suppliers.


text: The company describes whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect the company under the heading "Cybersecurity incidents as well as ransomware may hurt the company's business, damage its reputation, increase its costs, and cause losses," included as part of the company's risk factor disclosures in Item 1A of this Annual Report on Form 10-K. To date, there have not been any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, the company, including its financial condition, results of operations, or business strategies.


text: The Board of Directors of the company (the "Board"), primarily through its Audit Committee, oversees the company's cybersecurity program. The company's Chief Information Officer ("CIO") and Chief Security Officer ("CSO") regularly report to the Audit Committee on the current state of the company's cybersecurity program (including the current threat landscape, cybersecurity risks, and any significant incidents). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.


text: At the management level, the CIO and CSO receive regular reports from the company's cybersecurity department, both historical and real-time, about the company's global cybersecurity status. The company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). If management determines a material cybersecurity incident has occurred, the company's policies require management to promptly inform the Board.


text: Under the direction of the CIO, the CSO is responsible for global cybersecurity and business continuity, which includes security architecture, security operations, incident response, IT risk and compliance, and security awareness and training. The CSO has over 25 years of security experience and maintains certifications in risk, information security, and audit, among other disciplines. The other members of the company's security organization also have extensive cybersecurity, business, and technology experience and hold certifications in their area of expertise.


text: Strategy, Governance and Risk Management Our Technology Risk Program is designed to proactively identify, monitor, and mitigate technology-related risks across our digital operations and assess cybersecurity risks related to third-party vendors and suppliers. Our Cybersecurity Program and our Technology Risk Program are led by our Chief Information Security Officer ("CISO") a Certified Information Systems Security Professional with two decades of cybersecurity leadership. The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Technology Risk Oversight Committee chaired by our CISO, with members representing leadership throughout our Company, provides oversight and guidance to technology risks, including cybersecurity. Our Company's Cybersecurity Program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leading industry practices, and our Cybersecurity Program is integrated into our Company's Enterprise Risk Management framework. Internal and external experts regularly evaluate our Cybersecurity Program, and the results of those reviews are reported to senior management and our Company's Board of Directors. Our Incident Response Committee, which is comprised of leaders in the areas of information security, digital, legal, finance, privacy, compliance and ethics, corporate security and communications, is responsible for leading our Company's response to cyber incidents. Our Cybersecurity Incident Response Plan outlines the processes by which management is informed about and monitors detection and mediation of cyber incidents. We actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: Risks from cybersecurity threats, including as a result of previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, have not materially affected, and are not currently viewed as reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. However, we are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions. Cyber intrusions require a significant amount of time and effort to assess and remedy, and our incident response efforts may not be effective in all cases. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors — Significant cybersecurity incidents negatively impact our business and our relationships with customers, vendors and employees and expose us to increased liability for additional discussion.


text: Management has primary responsibility for risk management within our Company. The Company's Board of Directors, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. The Audit Committee of the Company's Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses. The Audit Committee receives reports on these matters from our most senior executives in the digital organization, including our Chief Information Officer and CISO, and the Company's executive officers, at least twice a year. Topics historically covered in such reports include third-party evaluation of our technology infrastructure and information security against the NIST cybersecurity framework; risk mitigation through the Company's enterprise-wide cybersecurity training, including our Board of Directors, conducted at least annually; regular simulated phishing tests and third-party penetration testing; review of the Company's cyber incident insurance coverage and external cyber incident resources; review of the Company's Cybersecurity Incident Response Plan and consideration of applicable laws and regulations, including those related to privacy. The Company's Cybersecurity Incident Response Plan includes a section on Board escalation that specifies the process for notification of the Chair of the Audit Committee and the Chair of the Board of the Directors upon certain triggering events, and that group then determines the appropriate form and frequency of communication with the full Audit Committee or Board of Directors, depending on the unique characteristics of the incident.


text: Risk Management and Strategy Managing Material Risks & Integrated Risk Management We have a comprehensive and systematic cybersecurity risk assessment program, which covers the identification, analysis, evaluation, and management of cybersecurity risks. The program follows a risk-based approach, which prioritizes the cybersecurity risks according to their likelihood and impact and allocates the appropriate resources and actions to mitigate these risks and leverages the National Institute of Standards and Technology (NIST) framework.

companyName: AGREE REALTY CORP

ticker: ADC


text: The program is cross-functional involving the participation and input of internal stakeholders, third-party consultants and board oversight. The program is reviewed and updated on a monthly basis, or whenever there is a significant change in our environment, operations, or objectives.


text: Engagement and Oversight of Third-parties We have contracted a reputable, global third-party external Security Operations Center ("SOC") to ensure that cybersecurity processes, tools, and monitoring are operating continuously. The SOC service provides a holistic view of our security landscape using a cloud-native Security Incident & Event Management platform, removing security siloes to gain actionable insights and providing continuous 24/7 detect and response services, as well as proactively identifying threats to prevent security disruptions.


text: We engage the SOC on a regular basis to conduct external audits and assessments of our cybersecurity posture and performance. The SOC provides independent and objective feedback and recommendations on how to improve our cybersecurity strategy, policies, processes, and controls. The SOC also assists the Company in identifying and prioritizing the most critical and emerging cybersecurity risks and threats, and to align our cybersecurity initiatives with the best practices and standards in the industry.


text: We also have a robust and rigorous oversight process for managing cybersecurity risks related to our third-party service providers. The process includes, conducting due diligence and background checks on the potential service providers, verifying their cybersecurity credentials, capabilities, and track record, establishing clear and specific contractual terms and conditions regarding the Company's cybersecurity expectations, obligations, and the responsibilities of the service providers, and monitoring and auditing the service providers' performance, compliance, reporting and escalation procedures for any cybersecurity issues or incidents identified.


text: Risks from Cybersecurity Threats While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - We face risks relating to information technology and cybersecurity attacks, loss of confidential information and other business disruptions. "


text: Board of Directors' Oversight Our board of directors takes an active and informed role in our risk management policies and strategies. Our executive officers, which are responsible for our day-to-day risk management practices, present to the board of directors on the material risks to our Company, including risks related to information technology and cybersecurity.


text: The audit committee has formal oversight responsibility for cybersecurity and is responsible for reviewing the Company's policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, the Chief Information Officer ("CIO") provides quarterly updates to the audit committee with respect to cybersecurity incidents, mitigation, and management.


text: Management's Role Managing Risk Our CIO is responsible for developing and overseeing matters related to cybersecurity and serves as the Company's Chief Information Security Officer. The CIO reports directly to the Chief Operating Officer, who is accountable for the overall information technology and security strategy and governance of the Company.


text: We have a comprehensive and continuous cybersecurity training program for our employees, which aims to raise their awareness and knowledge of cybersecurity threats and challenges, and to enhance their skills and competencies in preventing and responding to the cybersecurity incidents. The program covers the Company's cybersecurity policies, guidelines, cybersecurity best practice guidelines, cybersecurity scenarios and simulations.


text: In connection with improving the management of cybersecurity risk, the Company has: audited our systems with the help of information security consultants; completed ransomware simulations and enhanced our Disaster Recovery and Business Continuity Plan to reflect lessons learned; conducted recovery simulation of our proprietary database to determine restoration timing;


text: conducted penetration testing and remediated all issues identified; and enhanced e-mail filtering software to limit the possibility of phishing or ransomware attacks.


text: Monitor Cybersecurity Incidents We have a well-defined and tested cybersecurity incident response plan, which outlines the roles and responsibilities, procedures and protocols, tools and resources, and communication and escalation channels that will be activated and implemented in the event of a cybersecurity incident. The plan aims to detect and contain the incident, analyze and assess its nature, scope, and severity, and restore and resume the normal operations and functions of the Company.


text: Our business relies on computer systems to provide customer information, process customer transactions, communicate, and provide other general information necessary to manage our business. We also rely on a payment card industry- compliant third party to protect our customers' credit card information.

companyName: Waste Connections, Inc.

ticker: WCN


text: We assess, identify, and manage material risks from cybersecurity threats under our enterprise risk assessment framework, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical systems, assets and networks, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, our Information Technology and Safety teams are responsible for protecting physical processes, safety, production, efficiency, and protection of employees. Our Information Security group is directed at protecting all aspects of data and how information is stored, transmitted, processed, and used in business processes.


text: Our Information Security team of the Information Technology department has the direct responsibility for developing, monitoring, and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting, and training individuals throughout the Company in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT systems, assets, and networks are aligned with the parent company and affiliate cybersecurity framework. We engage independent third-party consultants from time to time to assess the adequacy of our cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. The Senior Vice President – Chief Information Officer, or CIO, who reports to the Executive Vice President and Chief Operating Officer, oversees this group and is responsible for managing the program, in collaboration with our business and functions. Our CIO has been in that role at the Company since 2004 and has extensive experience with cybersecurity and information technology at the Company.


text: Our vendor risk management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. We also have requirements for third-party service providers which include regulatory compliance and meeting NIST Cybersecurity Framework policy and standards. Our agreements with third-party service providers include cybersecurity provisions to address risks.


text: Our Security Incident Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to executive leadership and the Board of Directors based on an assessment of the risk and other specified criteria. We have established a cyber incident response team to prepare for, mitigate, and remediate cybersecurity incidents, which is integrated within our enterprise crisis management framework.


text: Cybersecurity risks are integrated into our overall risk management process through the collaboration of the cybersecurity professionals and our risk management functions to assess threat levels on at the subsidiary and parent company level and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through regular reports received from the CIO, which include updates on our performance with preparing, preventing, detecting, responding to, mitigating, and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to the Company, our processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or incident.


text: We are regularly the target of attempted cyber and other security threats and must continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. While to date the Company has not detected a significant compromise of its information and operating systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "We are increasingly dependent on technology in our operations and a failure of our technology could impact our ability to service our customers and adversely affect our financial results, damage our reputation, and expose us to litigation risk."