text: Cybersecurity Governance Our Director of Cybersecurity is responsible for the strategic leadership and direction of the Company's information security organization. The individual currently serving as the Director of Cybersecurity has over twenty years of experience working in information technology. The Director of Cybersecurity receives cybersecurity alerts from the Company's third-party security operations center, and provides periodic updates to the Head of Information Technology who informs the Company's executive committee, which includes the Company's Chief Executive Officer, Chief Operating Officer and, Chief Financial Officer.


text: Beginning last year, the Director of Cybersecurity also provides updates to the Audit Committee of the board of directors approximately on a quarterly basis. The Audit Committee, pursuant to its charter, reviews significant existing and emerging cybersecurity risks, including material cybersecurity incidents if any, the impact on the Company and its stockholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents.

companyName: Century Therapeutics, Inc.

ticker: IPSC

secItem: Item 1C


text: Risk Management and Strategy The Company considers cybersecurity risks as part of our overall risk management process. The management team works closely with our IT consultants and IT auditors to ensure potential risks are mitigated within our systems.

companyName: Epsilon Energy Ltd.

ticker: EPSN


text: The Company engages a third-party IT consulting firm and conducts an annual IT audit to test our risk management processes.


text: The Company, together with our IT consultants and auditors, has processes that thoroughly vet third-party service providers, continuously monitoring to ensure compliance with our cybersecurity standards. The Company has not encountered cybersecurity threats that have materially impacted our business or operations.


text: The Company's Board of Directors is aware of the impact of potential cybersecurity threats and stays in close contact with management in case a threat is identified.


text: The Audit Committee of the Board of Directors is the primary governing body that is tasked with the evaluation and confirmation of the Company's cybersecurity threat mitigation processes. More specifically, they review the Company's annual IT audits and discuss any potential threats in quarterly meetings.


text: The Chief Financial Officer, Chief Operating Officer, Controller, and Director – Finance are all involved in communications with our IT consultants and auditors. The Chief Financial Officer notifies the Audit Committee and Chief Executive Officer of any cybersecurity threats.


text: The Bank, as part of its risk management process, has implemented an information security program that encompasses the Bank's cybersecurity efforts. The Bank's goals of confidentiality, availability and integrity of its information are key to this process and program. The Bank's goals of protecting confidential information and safeguarding our digital assets are foundational objectives of the program.

companyName: PEOPLES FINANCIAL CORP /MS/

ticker: PFBX


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors of the Bank and Company annually approve this information security program and regularly receive a report from the Bank's Information Security Officer that outlines the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer updates the Boards of Directors of the Bank and Company monthly through supplementary reports on issues related to Cybersecurity readiness.


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer. Together with an Information Security Committee comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security Officer of the Bank works to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors of the Company and the Bank receive training on an annual basis.


text: The Bank engages trusted third parties to audit and examine its processes, review the security of its network infrastructure, and assist the Bank in designing and implementing robust cybersecurity systems. These trusted third parties help the Bank and the Company improve and test their cybersecurity readiness. The Bank engages third party vendors to monitor and test its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by specialized vendors that assist the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.


text: Although the Company and Bank have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected their business strategy, results of operations or financial condition, there can be no guarantee that the Company or Bank will not experience such an incident in the future.


text: As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Regulation and Supervision –Cybersecurity" included in Part I. Item 1 – Business of this report.


text: The Company recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks affecting the Company. The Audit Committee and senior management are actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: 22nd Century Group, Inc.

ticker: XXII


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages a third-party service provider specializing in information technology, which assists with the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: The Audit Committee oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. On an annual basis, the Audit Committee discusses with Senior Management cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. As applicable, the Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Senior management, in coordination with the Company's third-party service provider specializing in information technology, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communications with the third party service provider, Senior Management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.


text: In the ordinary course of our business, we and our third-party service providers, such as contract research organizations, contract manufacturing organizations, and managed service providers collect, maintain and transmit sensitive data on our networks and systems, including our intellectual property and proprietary or confidential business information (such as research and development data and personal information). The secure maintenance of this confidentiality, availability and integrity of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology applications and services to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: Verastem, Inc.

ticker: VSTM


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include assessment of, and response to internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations.


text: Our risk management team collaborates with our Chief Information Officer ("CIO"), our internal information technology ("IT") department, our Compliance team and our third-party IT managed service providers to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents. Our CIO and IT Department implement processes around security monitoring and vulnerability testing. We also have in place an incident response process for responding to and escalating cybersecurity events and incidents.


text: As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing of our systems, networks and web properties. We also employ internal security testing solutions and security awareness training for all employees.


text: We engage a security operations platform provider to assist us in monitoring, assessing and managing potential cyber events. We also perform periodic cyber maturity assessments to measure our cybersecurity profile against industry peers and standards.


text: We rely on third parties, including software-as-a-service and platform-as-a-services cloud vendors, for various business functions. Our third-party services providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business. We oversee these third-party service providers by conducting vendor diligence during contracting and onboarding and through ongoing monitoring. Vendors are assessed for risk based on the nature of their service, access to data and systems, and the level to which those systems and data impact our business. Based on that assessment, we conduct diligence that may include completing security questionnaires, onsite audits, and other technical and data security evaluations. Governance.


text: Our Board of Directors provides oversight of the Company's cybersecurity risk management program and integrates this oversight into its overall evaluation of enterprise risk. Our Audit Committee has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once each year and following any material cybersecurity incidents.


text: At the management level, our cybersecurity program is managed by our CIO, reporting into the executive leadership team. Our CIO has over 30 years of experience managing IT operations and cybersecurity within the pharmaceutical, biotechnology and high-tech industries.


text: Our CIO reports at least annually to the Audit Committee and such reporting will include an overall assessment of our compliance with our cybersecurity policies and procedures as well as topics that may include risk assessments, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures. In the event of a cybersecurity incident, the CIO reports the incident to the executive leadership team. If the cybersecurity incident is determined to be material the executive leadership team will report the incident to the Audit Committee or Board of Directors as appropriate.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or government investigations, litigation, fines or damages. For more information, see "Our business and operations may be materially adversely affected in the event of computer system breaches or failures" in Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Risk Management Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Corporation, including financial, operational, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Cyber Security Initiative ("CSI") committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization. The Information Security Officer reports directly to the Managing Director of Operations and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Cyber Risk Institute's cybersecurity profile designed specifically for the financial services industry, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, along with key members of our risk team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employe an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employe a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts, penetration testers, and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We have optimized our vulnerability management program that scans devices every four hours, and we have strict key performance metrics to ensure vulnerabilities are remediated quickly. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors. The Incident Response Plan is coordinated through the Chief Operating Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. For further discussion of risks from cybersecurity threats, see the section captioned "A disruption, breach, or failure in the operational systems or infrastructure of our third-party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business" in Item 1A. Risk Factors.


text: Our Information Security Officer is accountable for managing our enterprise information security processes and procedures and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the CSI Committee, provides guidance, oversight, monitoring, and challenge of the first line's activities. The Committee as a whole, consists of information security professionals with varying degrees of education and experience as well as Information Technology professionals, and audit and fraud professionals. Individuals within the Committee are generally subject to professional education and certification requirements. In particular, our Information Security Officer has the necessary relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the CSI Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. There are also three technology steering committees that plan and guide technology projects in alignment with the Corporation's strategic plan. These committees are chaired by managers and experts within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company. These committees generally meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Risk and Compliance Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The Risk and Compliance Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our CSI Committee provides quarterly reports to the Risk and Compliance Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Risk and Compliance Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk and Compliance Committee of our board of directors reviews our cyber security risk profile on a regular basis. The Risk and Compliance Committee our board of directors provides a report of their activities to the full board of directors at board meetings.


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, violation of privacy or security laws and other litigation and legal risk; and reputational risks. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future.

companyName: MetaVia Inc.

ticker: MTVA


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards. We work with a third-party provider to monitor threats and potential cybersecurity breaches.


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or reported by our third-party monitoring service that may affect our information services and have processes to assess those issues for potential cybersecurity impact or risk. We impose security requirements upon our suppliers and CROs, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations, and oversight structures. The Board is assisted by the audit committee, which reviews our cybersecurity program with management and reports to the Board.


text: The audit committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The audit committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Our Chief Executive Officer, Chief Financial Officer and corporate controller have operational experience in assessing and managing cybersecurity risk. Our Chief Executive Officer plays a pivotal role in informing the audit committee on cybersecurity risks. They provide comprehensive briefings to the audit committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the audit committee and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the board's oversight is proactive and responsive. The audit committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of MetaVia.


text: Our Chief Financial Officer is informed by our third-party monitoring service of any cybersecurity incidents, who will then escalate the incident to our Chief Executive Officer, if necessary. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include operational risks, intellectual property or trade secret theft, improper disclosure of confidential information, fraud, extortion, harm to employees or customers, and violation of data privacy or security laws.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal information technology ("IT") audits, and IT security reviews. To defend, detect, and respond to cybersecurity incidents, we perform cybersecurity reviews of systems and applications; audits of applicable data policies; vulnerability assessments and penetration testing using external third-party tools to test security control; security incident and event management; continuous monitoring, and threat intelligence gathering; conduct employee training; and implement appropriate changes. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We leverage third-party expertise to audit and test our cybersecurity program and perform employee awareness training. These include periodic reviews of cybersecurity threats and related controls, including review of periodic penetration testing conducted by independent third parties.


text: We maintain a cyber liability insurance plan underwritten by multiple insurance companies, which provides protection against certain potential losses arising from cybersecurity incidents.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors ("Board of Directors") and management. Our Board of Directors delegated oversight of Cybersecurity to the Audit Committee. Members of our Board of Directors receive reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as service providers and suppliers, and the current threat environment. These updates are presented by IT third-party experts, finance, and legal departments. Members of our Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and updates to our cybersecurity risk management and strategy programs. Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; Reviewing our risks and cybersecurity programs and policies; Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs;


text: Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy.


text: Our management engages with third-party experts who have significant IT expertise and broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats, business continuity and disaster recovery, and regulatory compliance. Such individuals have significant prior work experience in various roles involving IT security, auditing, compliance, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents and design.


text: Cybersecurity Risk Management and Strategy Our technology and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to maintain stakeholder trust. Our Chief Financial Officer ("CFO") is responsible for establishing, implementing and executing our cybersecurity program and strategy. Our CFO has over nine years of information technology, information technology audit, and cybersecurity experience, and is involved in following the latest developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.


text: Our personnel responsible for cybersecurity proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: cyber incident response, IT disaster recovery, and business continuity plans; cybersecurity assessments and remediation planning as part of our due diligence process; and identity and access management controls.


text: A primary element of our cybersecurity program is the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. We do not engage third parties in connection with our cybersecurity program.


text: Cybersecurity Governance Our Board of Directors oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. Annually, the Board of Directors receives an update from our CFO and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, and notable incidents or events should they occur. In accordance with our cybersecurity incident response plan, our Board of Directors is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future. For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect us, see our risk factors, including the risk factors titled "Our strategy includes an increasing dependence on technology in our operations. If any of our key technology fails, our business could be adversely affected." and "A cybersecurity incident could negatively impact our business and our relationships with employees, service providers, patients, clinical study sites and government agencies." in Item 1A of this Annual Report on Form 10-K.


text: Cyber Risk Management and Strategy Under the oversight of our board of directors and the Audit Committee of the board, we have adopted cybersecurity risk management processes that take a risk-based approach to assessing, identifying, and managing risks from cybersecurity threats. Management of cybersecurity risks is part of our overall risk management strategy.

companyName: TELA Bio, Inc.

ticker: TELA


text: We engage third-party service providers to assist us with our cybersecurity risk management, including for network monitoring, antivirus protection, and managing IT environments. We have also engaged third party advisors and consultants to conduct periodic testing of our processes and systems. Before contracting with certain third parties, such as those that have access to our IT networks, we have a process to conduct diligence on those third parties, which includes a security assessment. We have also implemented a process for employees to undergo cybersecurity training during onboarding, and thereafter, on an annual basis as part of our larger compliance training program.


text: We have established monitoring procedures in our effort to mitigate risks related to cybersecurity incidents. As part of our cybersecurity risk management, we have adopted a business continuity and incident response plan, which is designed to establish our processes for identifying and responding to significant events that may lead to a business disruption or crisis, including those arising from or related to cybersecurity threats.


text: Our board of directors holds oversight responsibility over our strategy and risk management, including risks related to cybersecurity. The board's oversight of cybersecurity risk management is supported by the Audit Committee, which has responsibility for discussing with management significant cybersecurity risks and the measures we have implemented to monitor and control such cyber risk exposures. The Audit Committee receives quarterly updates from our Vice President, Information Technology ("IT Officer") relating to IT and cybersecurity matters, including cybersecurity risks and threats. The Audit Committee provides periodic updates to our board of directors on cybersecurity matters discussed at such meetings. Our IT Officer also provides these and similar reports to the full board of directors on a biannual basis.


text: Our IT Officer oversees the day-to-day management of the Company's cybersecurity risk management program. Our IT Officer has over 15 years of experience in IT leadership and has managed IT for our company for approximately 10 years. Our IT Officer reports to our Chief Operating Officer and Chief Financial Officer and is a member of our Compliance Committee. Our IT Officer coordinates with our legal department and relevant third parties, such as consultants and external legal advisors, to assess and manage material risks from cybersecurity threats. Our IT Officer is also supported by a cross-functional incident response team, which is empowered to review, assess, report, monitor and take action to mitigate or remedy any cybersecurity incidents pursuant to our business continuity and incident response plan. Our IT department further supports and has dedicated resources to assist our IT Officer in monitoring, preventing, detecting, mitigating, and remediating any cybersecurity incidents pursuant to our policies and procedures.


text: We have also established a Disclosure Committee, which regularly reviews relevant information related to potential public disclosure of critical business risks and material events.


text: We have not identified any cybersecurity incidents or threats that have materially affected our information or system or are reasonably likely to materially affect our information and systems, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Form 10-K.


text: Risk Management and Strategy The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess, and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company engages a third-party provider to conduct periodic maturity assessments. The Company stores data in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: Our cybersecurity program is managed by the Annovis Incident Management Committee (the "AIMC"). The AIMC serves as the core team responsible for managing the enterprise-wide cybersecurity policy, maintenance and compliance across all platforms. The AIMC is responsible for the detection and initial assessment of potential cybersecurity threats and incidents. The AIMC classifies detected cyber incidents to allow prioritization, response and escalation. Incidents (if any) are documented for internal reporting processes and regularly shared with senior management.


text: Our third-party IT service provider is a key part of our cybersecurity program. We partner with a cybersecurity company and leverage their technology and expertise to better protect the Company. From time to time, we engage this vendor to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. We intend to continue to work to formalize our cybersecurity program, including developing processes for third-party service provider cyber-risk oversight and management.


text: In the event of a potential cybersecurity incident, the AIMC will conduct an assessment to determine the nature and scope of the incident and manages the incident in accordance with our incident response plan until the incident is contained and resolved. The AIMC will document findings and make them available to the Disclosure Committee, which includes cross functional senior management representation from, legal, finance, investor relations and business segments. The Disclosure Committee, in conjunction with third-party experts, including outside legal counsel, is responsible for assessing the materiality of any cybersecurity incident and coordinating external communications and disclosures, including with the Securities and Exchange Commission.


text: As of December 31, 2024, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition, although we may be materially affected in the future by such risks or future material incidents. See "Risk Factors—Risks Related to Our Business Operations—Disruption, failure or cyber security breaches affecting or targeting computers and infrastructure used by us or our business partners may adversely impact our business and operations" for additional information regarding cybersecurity risks.


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for the Annovis management and Board of Directors. We continue to invest in cybersecurity and enhance our internal controls and processes, which are designed to help protect our systems and the information they contain.


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board has delegated to the Audit Committee the responsibility to oversee the integrity of the Company's information technology and cybersecurity risks and to assess the risks and incidents relating to cybersecurity threats. While our Board and Audit Committee oversee cybersecurity risk, management, through the AIMC, is responsible for the implementation and management of cybersecurity risk management systems and processes and for the communication of incidents to senior management and the Audit Committee.


text: The AIMC meets with the Audit Committee on a quarterly basis and meets with the BOD at least annually. Additionally, the Audit Committee regularly meets with members of the Company's internal audit function to discuss risk management activities, compliance, best practices, and other related matters.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, our day-to-day operations are managed by the Adviser under the oversight of our board of directors. Our executive officers are senior professionals of the Adviser. As such, we are reliant on the Adviser to provide to us with information regarding its cybersecurity program that is relevant to us.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: The Adviser maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. The Adviser utilizes a variety of protective measures as part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software, among others.


text: The Adviser tests its cybersecurity defenses regularly through automated and manual vulnerability scanning to identify and remediate critical vulnerabilities. In addition, it conducts tests to validate its security posture. Further, the Adviser engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by the Adviser's information technology security team in collaboration with outside service providers as appropriate and includes members of the Adviser's senior management and Legal/ Compliance team. Learnings from these tabletop exercises and any events that the Adviser experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to the Adviser's internal exercises to test aspects of its cybersecurity program, the Adviser periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of the Adviser's information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.


text: The Adviser has a comprehensive cybersecurity incident response plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: The Adviser maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. The Adviser's Vice President, IT Security periodically discusses and reviews cybersecurity risks and related mitigants with the Adviser's Information Security Steering Committee and incorporates relevant cybersecurity risk updates and metrics.


text: The Adviser employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: In the last three fiscal years, we have not experienced a material information security breach incident, and the expenses we have incurred from information security breach incidents have been immaterial. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the Adviser and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors—Cybersecurity risks could result in the loss of data, interruptions in our business, damage to our reputation and subject us to regulatory actions, increased costs and financial losses, each of which could materially adversely affect our business and results of operations." in this Annual Report on Form 10-K.


text: Cybersecurity Governance The Adviser has a dedicated cybersecurity team, led by its Vice President, IT Security, who works closely with the Adviser's Information Security Steering Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. The Adviser 's Information Security Steering Committee includes its Chief Information Officer, Chief Risk Officer, and General Counsel.


text: The Vice President, IT Security has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across the Adviser. He has a has more than 26 years of experience in diversified information technology and security. He holds a Bachelor's degree in Electronics and Communication Engineering. He possesses industry-recognized certifications such as CISSP, CRISC, and CISM The Adviser conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The Vice President, IT Security reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. The Vice President, IT Security also reviews the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of the Adviser's information and systems.


text: Our board of directors is responsible for understanding the primary risks to our business, including any cybersecurity risks, and has delegated such responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. The board of directors and audit committee may also receive periodic updates from management as to our and the Adviser's cybersecurity risks and the Adviser cybersecurity program developments.


text: Risk Management and Strategy We have robust programs in place for assessing, identifying and managing material risks from cybersecurity threats. Our approach leverages a comprehensive suite of security tools and initiatives, including but not limited to, Managed Security Service Providers, Extended Detection and Response monitoring, internal reporting mechanisms, and advanced detection and monitoring tools. Our information security program is continuously evaluated through internal audits and a range of security exercises, including tabletop simulations, penetration testing, vulnerability assessments and red team exercises. Identified security gaps from these assessments are systematically integrated into our risk remediation processes and incorporated into our security tools and applications to enhance our overall cybersecurity policies and procedures. In addition, we conduct annual Payment Card Industry Data Security Standard compliance reviews and independent third-party penetration testing to ensure our defenses remain resilient and aligned with industry best practices.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Our global cybersecurity team is composed of multidisciplinary Information Technology ("IT") professionals from key regions, led by our Global Director of Cybersecurity. This team is responsible for providing comprehensive reporting to executive management and auditors, covering cybersecurity threats, assessments, findings and strategic direction for future improvements.


text: We ensure continuous endpoint monitoring in collaboration with a third-party cybersecurity firm. For high or critical severity incidents, rapid response protocols are in place, including isolation, segmentation and forensic analysis by our cybersecurity team. Additionally, we have engaged a dedicated third-party threat hunter to assist in identifying Indicators of Compromise.


text: Our Global Director of Cybersecurity leads a quarterly cybersecurity governance meeting, bringing together IT teams from all subsidiaries. This meeting serves as a forum to review ongoing and upcoming security initiatives, regulatory compliance and industry best practices.


text: We conduct an annual tabletop exercise facilitated by an external cybersecurity specialist. This exercise simulates various attack scenarios, testing our incident response plans and procedures to ensure effective threat detection, mitigation and remediation. It also evaluates potential business impacts, including business continuity, backup strategies, data protection, compliance, and regulatory requirements such as GDPR, CCPA and PCI. Participants include IT leadership, finance, legal, insurance, and operations teams across all subsidiaries, ensuring a coordinated and well-prepared response to cybersecurity threats.


text: Our cybersecurity resilience is further strengthened through annual penetration testing performed by a leading third-party firm. This assessment includes external and internal penetration testing, Wi-Fi security evaluations, social engineering exercises and physical access testing. We leverage a vulnerability management platform to maintain comprehensive asset visibility, systematically identify risks and prioritize remediation efforts. Additionally, all corporate employees with system access must complete annual data protection and cybersecurity training to reinforce security awareness and compliance.


text: Our third-party IT vendors undergo independent audits to validate their compliance with System and Organization Controls ("SOC") 1 and SOC 2 standards. Vendor access to our networks is restricted to the applications necessary for their services. We proactively assess vendor risk using third-party rating tools, quantifying vulnerabilities and engaging vendors in remediation efforts to mitigate potential security threats.


text: To further enhance our risk mitigation strategy, we maintain annual cybersecurity insurance policies designed to offset costs associated with covered cybersecurity incidents.


text: Our board of directors provides comprehensive oversight of enterprise risk management, including information security, technology and cybersecurity threats. The audit committee of our board of directors is responsible for evaluating the adequacy and effectiveness of internal controls, particularly those designed to assess, identify and manage material cybersecurity risks. The audit committee receives quarterly cybersecurity reports from the Chief Information Officer ("CIO") and cybersecurity team, detailing material risks, threats and mitigation efforts. In the event of a cybersecurity incident, the Global Director of Cybersecurity or senior IT leadership will escalate the issue to the Disclosure Committee, following the Incident Response Plan's predefined escalation criteria. Security incidents are classified based on severity (Critical, High, Medium), impact, and nature, ensuring efficient risk prioritization, resource allocation and incident response management.


text: Our Disclosure Committee includes key executives and senior leadership, including the Executive Vice President, Chief Growth and Operations Officer, Chief Financial Officer, CIO, Senior Vice President of Finance, Senior Vice President of Investor Relations and Treasurer, Senior Vice President of Legal Counsel and Vice President of Legal Counsel. Additionally, it comprises senior representatives from financial reporting, internal audit, financial planning and analysis, and tax functions, ensuring a comprehensive approach to risk oversight and compliance.


text: Our CIO has over 28 years of experience leading our technology operations and more than 40 years of expertise in information technology, spanning the banking and fashion apparel industries. Our Global Director of Cybersecurity has over 20 years of experience in information technology, with a specialized focus of more than seven years in cybersecurity, risk management, and compliance. He holds Certified Information Systems Security Professional ("CISSP") and Certified Ethical Hacker ("CEH") credentials. Additionally, he serves as a governing body member for the New York Evanta CISO community.


text: For further discussion of the risks associated with cybersecurity incidents, see our "Risks Related to Cybersecurity, Data Privacy and Information Technology" under "Risk Factors."


text: Risk Management and Strategy We have processes in place to regularly assess, manage and identify potential risks from cybersecurity threats. Our cybersecurity policies and processes are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools and processes that are designed to help identify and investigate any security incidents in a timely manner. When any risk or threat is identified we have a designated group of individuals including representatives from our information security team, finance team, compliance teams and legal teams who are involved in the assessment of the risk based on probability and potential impact to key business systems and processes. Risks that are considered to have a high impact to our business are incorporated into our enterprise risk management program. The tracking of these risks and the processes we have in place to address cybersecurity threats are tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Adaptimmune Therapeutics PLC


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary.


text: As part of our overall risk management system, we train our staff on the safeguards we have in place to mitigate cybersecurity threats and ensure employees are able to identify potential attempts to breach our security and how to report and deal with any potential threats. We have procedures in place to assess and manage potential supply chain risks posed by third-party vendors and collaborators. As part of our cybersecurity risk management program, we work with certain third-party vendors to assess their cybersecurity processes, including a process for requesting that vendors who have access to our systems and data complete cybersecurity questionnaires prior to onboarding.


text: We have not identified any cybersecurity threats that have materially affected our ability to conduct our business or our financial standing. Refer to the risk factor captioned " Our internal information technology systems, or those of our partners, third-party CROs or other contractors or consultants, may fail or suffer cybersecurity incidents, including related to data protection and privacy laws and adversely affect our business and operations " in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks. The Audit Committee of the board oversees our risk management program on behalf of the Board of Directors, which focuses on the most significant risks. Audit Committee meetings include discussions of any specific risk areas which are significantly increasing or which are of particular concern and at least once a year a third party expert in cybersecurity works with the Audit Committee and our Information Management team to assess the processes and controls we have in place around cybersecurity We have introduced corporate policies and training on these policies for all of our staff. Our Information Management team, and in particular our information security team together with the corporate compliance team are responsible for ensuring compliance with these corporate policies. Our Chief Operating Officer and Compliance Offic er oversees our policies and is primarily responsible to assess and manage material risks from cybersecurity threats, with assistance from third party experts as appropriate and our legal team. Our Global VP of Information Management has overall responsibility for our day to day cybersecurity procedures. We also have a Director heading up our global security and cybersecurity team and a dedicated member of the team overseeing cybersecurity threats and activities. Together those individuals have over 20 years of combined experience of information security.


text: The Company deploys advanced cybersecurity technologies and best practices to deliver a highly secure technology platform for its internal operations and hotels throughout its national portfolio. Our program is built around best practice guidance taken in part from both NIST and PCI DSS framework.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Risk Management and Strategy We have engaged a third-party IT and cybersecurity firm to assist us in protecting us from cybersecurity threats. Our IT partner has been in business for over 33 years and has a national footprint of 175 offices nationwide. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers.


text: TPG's Corporate IT footprint and systems are not used to process guest transactions. Corporate systems do not have connectivity to any hotels.


text: All IT assets and infrastructure are monitored 24/7/365 through a combination of MDR, SIEM software and a fully staffed 24/7 SOC. We have continuous monitoring for viruses, intrusions, and malicious activities.


text: We deploy a sophisticated blend of layered security that protects systems and data that exist or operate within partitioned/segregated networks.


text: Employee cybersecurity training and phishing email training are required for all employees and is performed monthly to continually enhance awareness and responsiveness.


text: We do not store any customer data input during the reservation process. The customer reservation systems are specified, implemented, and managed by the global hotel brands.


text: Each hotel or operating asset within our portfolio is a standalone network. Therefore, if a security breach were to occur at one location, it is fully isolated from other properties or networks.


text: We deploy stringent email filtering that prohibits incoming messages from insecure email systems (i.e., gmail, yahoo, aol, etc.) that are known to carry viruses, spyware, crypto ransom, etc. We perform regular internal and external penetration tests at the hotel property level.


text: We have in place a Cybersecurity Incident Response plan that dictates the process for responding to incidents and remediation of events. We have relationships with third-party business partners to assist with cybersecurity as well as assess their cybersecurity risks.


text: We utilize Self-Assessments using industry standards and benchmarks to identify cybersecurity incidents and threats that could potentially impact the company.


text: Our IT internal controls are audited by an external audit firm as part of our Sarbanes-Oxley Act compliance activities, and this process includes assessing the design and operating effectiveness of those controls.


text: We or our third-party manager currently maintain cybersecurity insurance policies that provide coverage for security incidents. Although the risks we face from cybersecurity threats are many and change daily, in the last three fiscal years, we have not experienced any cybersecurity incidents that have materially affected our operations, strategy, financial positions or operations. In addition, as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations and financial condition. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors-Risks Relating to Our Business- We are increasingly dependent on information technology, and potential cyber-attacks, security problems or other disruption and expanding social media vehicles present new risks."


text: Despite the policies and procedures that have been implemented to ensure the integrity of our IT systems, we may not be effective in identifying and mitigating every risk in which we are exposed to, especially newly identified vulnerabilities. Furthermore, the hospitality environment requires that the hotels access information in third party environments that are managed, hosted, and provided by others. As such the company will have difficulties in anticipating and implementing preventive measures that mitigate the harm should a break occur.


text: Malicious actors, which can operate on a larger and more sophisticated scale, are using various tools and methodologies to gain access to systems. Such attacks are ransomware, denial of service attacks, phishing, social engineering, and other cyberattacks. A breach of these systems either managed by us or a third party may result in the loss of business data, personal information, disruption of business.


text: Our board of directors are responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On a quarterly basis, our board of directors and audit committee receive a report from management on our cybersecurity threat risk management processes and strategies. Outside of quarterly meetings, our board of directors and audit committee are notified following any cybersecurity incident and meet to address and identify the cybersecurity threat's severity levels. Our board of directors and audit committee also review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.


text: Risk management and strategy Our accounting and financial reporting platforms and related systems, and those that we, or our third-party service providers, offer to TPHGreenwich's tenants are necessary for the operation of our business. We use these platforms and systems, among others, to manage our tenant relationships, for accounting and financial reporting, and for other recordkeeping purposes. Our business operations and financial reporting rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Trinity Place Holdings Inc.

ticker: TPHS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on our management and third-party service providers to manage any perceived cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, internal controls within our accounting and financial reporting functions, network security controls, access controls, physical security, systems monitoring, and employee training.


text: We work with third parties from time to time that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms and information technology consulting and support firms. To operate our business, we utilize certain third-party service providers to perform a significant portion of our critical functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. To address risks associated with third-party service providers, we will review and assess the cybersecurity controls of our third-party service providers and make changes to our business processes to manage these risks. This approach is designed to mitigate risks related to data breach or other security incidents originating from third-party service providers.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Steven Kahn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Kahn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2015. Mr. Kahn currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Kahn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any serious cybersecurity incidents to our Board.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development, to communicate internally and externally, to operate our accounting and record-keeping functions, to store and access data including sensitive patient data and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Solana Co

ticker: HSDT


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or patients, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.


text: In coordination with third-party consultants, we have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct annual reviews and tests of our information security program to evaluate its effectiveness and improve our security measures and planning.


text: To operate our business, we utilize certain third-party service providers and vendors to support a variety of functions. We seek to engage reliable, reputable service providers and vendors that maintain cybersecurity programs, and we implement a vetting process to ensure that all third-party service providers and vendors comply with our cybersecurity program requirements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. Oversight of such cybersecurity risks is executed directly by the Board of Directors. The Board receives reports and engages in regular discussions with management regarding the Company's significant risk exposures resulting from material cybersecurity threats and the measures implemented to monitor and reasonably manage these risks.


text: Our Director of Information Technology leads our information security organization and reports to our Chief Executive Officer and Chief Financial Officer on matters related to cybersecurity who then in turn report to the Board of Directors any material information regarding such cybersecurity matters. Our Director of Information Technology has over 30 years of IT experience and has developed a focus of experience in the healthcare industry.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Corvus Pharmaceuticals, Inc.

ticker: CRVS


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee has received reports from management on our cybersecurity risks and will receive such reports on a periodic basis going forward. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities which include those related to cybersecurity.


text: As part of our management team, Leiv Lea, our Chief Financial Officer, who has over fifteen years of experience overseeing information technology systems for public companies, is responsible for assessing and managing our material risks from cybersecurity threats. Mr. Lea has primary responsibility for our overall cybersecurity risk management program and supervises our retained external information technology and cybersecurity consultants. Mr. Lea supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from security personnel and alerts and reports produced by security tools deployed in the Company's information technology environment.


text: Risk Management and Strategy Juniata's risk management program is designed to identify, assess and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Juniata's Information Security Officer ("ISO") and SVP/IT Manager are primarily responsible for the cybersecurity component of the risk management program and are key members of the organization, both of which have a clear line of reporting directly to the Board of Directors and are involved with management's Information Technology ("IT") Steering Committee. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Juniata's policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats are based on the framework established by the Federal Financial Institutions Examination Council ("FFIEC") Guidelines and Cybersecurity Assessment Tool ("CAT"), which consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. The FFIEC CAT tool will no longer be updated after August 31, 2025, therefore, JVB will replace this tool with another tool such as the NIST 2.0 standard.


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act 12 CFR 364, Appendix B, integrating people, technology, and processes. The program includes company-wide employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management and incident response. Juniata's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse its systems or information. The information security program is periodically reviewed by the Company's SVP/IT Manager and ISO with the goal of addressing changing threats and conditions.


text: The Company also employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. The Company established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. Juniata engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also actively monitors its email gateways for malicious phishing email campaigns and remote connections as some of its workforce has the option to work remotely.


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, particularly in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Management Policy, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the FFIEC guidelines for third-party risk management. The Vendor Management Policy is audited periodically in accordance with the Board of Directors approved Internal Audit plan.


text: Juniata leverages internal and external auditors and independent external partners to periodically review its processes, systems and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted, by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: The Company maintains a Business Continuity Plan (the "Plan") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board of Directors-approved management committees, as discussed further below, and to the IT Steering Committee. The Plan is coordinated through the SVP/IT Manager and ISO, and key members of management are embedded into the Plan by their design. The Plan facilitates coordination across multiple parts of the Company and is evaluated at least annually.


text: Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents;


text: Coordinating incident response or crisis management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents;


text: Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures;


text: Providing company-wide training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plan; and Reviewing the Plan at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: Management has overall responsibility for risk oversight. The Company's SVP\IT Manager is accountable for managing enterprise information security and delivering the information security program. These responsibilities include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third party risk management and business resilience as it relates to the cybersecurity program.


text: The foregoing responsibilities are covered on a day-to-day basis by the SVP/IT Manager and ISO. The ISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 23 years of cybersecurity experience, 19 of which has been spent at a CPA firm specializing in banking industry financial and information technology audits. The ISO provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Board of Directors.


text: The IT Steering Committee focuses on technology and business impact and is responsible for overseeing the Company's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The ISO and SVP/IT Manager provide quarterly reports to the IT Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes. The IT Steering Committee reviews and approves the information security and technology budgets and strategies annually.


text: The IT Steering Committee focuses on the identification, monitoring, assessment, and management of risk associated with the Company's cyber and information security programs. The IT Steering Committee reviews key metrics summarizing the Company's cyber security risk profile on a quarterly basis.


text: Both the IT Steering Committee and the Board of Directors provide oversight and governance of the technology program and the information security program. Both committees meet at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan (part of the Plan) to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity incidents discussed at committee meetings and the actions taken to the IT Steering Committee on at least a quarterly basis, or more frequently as may be required by the Incident Response Plan, and to the Board of Directors on at least an annual basis. Additionally, the ISO reports directly to the Board of Directors, at least annually, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing security breaches or violations are discussed, as are management's responses and any recommendations for program changes.


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Village Bank & Trust Financial Corp.


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge and testing; using a third-party cybersecurity oversight program;


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and We had no material cybersecurity incidents in 2024.


text: Risk Management and Strategy Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside partners to assist us in overseeing our cybersecurity risk management program.


text: We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.


text: While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Risk Committee, or to the full Board, as appropriate.


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Our Board Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Board Risk Committee actively engages with our Chief Risk Officer and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Board Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Board Risk Committee is engaged, as needed, in accordance with our Incident Response Plan.


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our Chief Risk Officer is responsible for implementing our enterprise risk management framework and reports directly to our Chief Executive Officer.


text: Our first line of defense is our employees. Employees receive training, at least annually, on information security. In addition, our Information Security Officer provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials.


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our Management Risk and Compliance Committee, which governs our technology and operational risk tolerances, including cybersecurity and third- and fourth party provider risks. This committee includes the Information Security Officer, the SVP of IT and the Chief Risk Officer. The Committee is responsible for escalating key risks to our Executive Leadership Team.


text: Internal Audit serves as the third line of defense and provides independent assurance on how effectively we are mitigating, managing, and challenging our cybersecurity risks.


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, as well as confidential information that is proprietary, strategic or competitive in nature.

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR