text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Company's Board of Directors (the "Board") is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Company's overall risk management processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Kayne DL 2021, Inc.

secItem: Item 1C


text: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.


text: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Company's cybersecurity systems.


text: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: Adviser has established an internal working group that includes relevant representation from senior management including the CCO, CFO, and CISO, and CTO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO, CTO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: of the internal working group have multiple decades of experience in information security and risk management, including assessing cybersecurity threats. Furthermore, the CTO and CISO have educational backgrounds and hold professional experience and certifications relevant to management of cybersecurity.


text: Effects of Cybersecurity Incidents from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Company has a dedicated internal IT department with cybersecurity engineers who oversee various aspects of cybersecurity. These engineers specialize in different areas, including ensuring security during product development, particularly in the domains of cloud management platforms and network interactions, as well as managing cybersecurity for daily office communications.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: the event of an unexpected cybersecurity incident, the engineers immediately report to the Company's management. They are equipped with pre-established response plans to address such situations effectively and mitigate potential risks.


text: our cybersecurity risk management relies primarily on internal resources. However, as the Company continues to expand, we anticipate engaging third-party consultants to assist in enhancing our cybersecurity management processes and addressing evolving threats.


text: we do not currently have third-party collaborations, the Company plans to implement a process for selecting and evaluating third-party service providers in the future. This will include comparing services, signing security agreements, and having our internal engineers assess the third parties' achievement of security objectives.


text: the past three years, our Company has not experienced any material cybersecurity risks. To ensure robust protection against potential threats, we have implemented the following security measures: Regularly updating and changing critical passwords. modifying communication interfaces to enhance security. development tasks in a modular fashion to minimize exposure. dual-factor authentication for system access. tiered authorization levels for critical network operations. routine security training and awareness programs for employees.


text: the Company's board of directors does not oversee cybersecurity risks directly. However, plans are in place to introduce such oversight in the future. The Audit Committee of the Board will assume responsibility for cybersecurity risk oversight, with a plan to review cybersecurity matters on a quarterly basis. This initiative will ensure that the Company maintains robust oversight mechanisms to address evolving cybersecurity threats effectively.


text: responsibility for assessing and managing cybersecurity risks within the Company lies with the managers of the R&D department and the IT department. Both individuals possess relevant expertise in their respective fields, ensuring a high level of competence in identifying and mitigating cybersecurity risks. Their duties include monitoring potential threats, implementing security protocols, and responding the event of cybersecurity incidents or abnormal alerts, the relevant department managers immediately intervene and manage the situation.


text: All logs and records related to such events are preserved for future analysis. Cybersecurity testing is incorporated into every stage of product development, ensuring that vulnerabilities are identified and addressed proactively. Additionally, server security patches are regularly updated to mitigate potential threats.


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: ADIAL PHARMACEUTICALS, INC.

ticker: ADIL


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of Adial's cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Adial's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our management team and key staff participate in regular cybersecurity training created by industry recognized cybersecurity providers. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Adial acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program, in conjunction with our enterprise risk management assessment processes, address cybersecurity risks to the corporate information technology, or IT, environment including systems, hardware, software, data, people and processes.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, and processes and controls supporting data protection requirements under applicable law. The NIST CSF offers a thorough set of guidelines and best practices to help establish a strong cybersecurity posture. Utilizing NIST CSF enables us to systemically identify, assess, and manage cybersecurity risks most relevant and impactful to our business operations. It is important to note that using the NIST CSF as a guide does not imply our cybersecurity program meets any specific technical standards or requirements.


text: We have an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies and categorizes significant cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, developed a risk mitigation plan to address such cyber risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: In addition, we maintain policies over areas such as protecting and handling confidential information, processing of personal data, access on/off boarding, user management, acceptable use, and IT change control management to help govern the processes put in place by management designed to protect our IT assets, data and services from threats and vulnerabilities. We employ additional key practices within the cyber risk management program including, but not limited to maintenance of an IT assets inventory, periodic network scans, identity access management controls including restricted access to privileged accounts, and physical security measures at our facilities. We also utilize information protection/detection systems, or IPS/IDS, including maintenance of firewalls and anti-malware tools, network and data traffic monitoring with automated alerting, ongoing cybersecurity user awareness training, industry-standard encryption protocols, formalized change management processes and critical data backups to reduce cybersecurity risk.


text: Cybersecurity partners, including assessors, consultants, advisors and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data and services. The cybersecurity partners provide services including, but not limited to systems inventory monitoring, configuration management, periodic network scanning, user management, mobile device monitoring, capacity monitoring, network protection and monitoring, IPS/IDS management, remote access monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third parties that may lead to a service disruption or an adverse cybersecurity incident. This includes processes for performing third-party risk ratings and data classification mapping of current and ongoing vendors. The program promotes good cybersecurity practices with our third-party vendors and helps to ensure their adherence to our cybersecurity standards.


text: In evaluating the risks identified as a result of the annual cybersecurity assessment process, our cybersecurity partners assist the Company to assess the likelihood, severity, and impact of relevant risks, including the impact on employees, stakeholders, and vendors. These risks are prioritized and monitored by the cybersecurity partners and management of the Company.


text: Our cybersecurity program includes an incident response plan that includes all relevant and critical members of management and third-party service providers alike.


text: The team is responsible for assessing and managing cybersecurity incident response processes, response times, and communication plans in the event corrective actions and mitigation procedures are required to isolate and eradicate an incident.


text: Our finance leadership team, led by our chief financial officer, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. Our finance leadership team has experience selecting, deploying and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners.


text: We also rely on threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making.


text: The Audit Committee of the Board of Directors, or the Audit Committee, oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk advisory services, brief the Audit Committee on cyber threats and vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, the emerging threat landscape, and new cyber risks on at least an annual basis.


text: This includes updates on our processes to prevent, detect and mitigate cybersecurity incidents. In addition, the Audit Committee is responsible for reporting information about such risks to the Board of Directors and material cybersecurity risks and/or events are reviewed by the Board of Directors, at least annually, as part of our corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation.


text: We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. However, prior cybersecurity incidents have not been material and are not reasonably likely to have had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal policies, processes, and operations; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors and additional stakeholders, which could subject us to additional liability and reputational harm.


text: In response to such risks, we have implemented initiatives such as our cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on Company cybersecurity risks.


text: a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats.

companyName: ASPAC III Acquisition Corp.

ticker: ASPC


text: However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of Oxford Funds and other third -party service providers. Oxford Funds manages the day -to-day operations of the Company and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: Cybersecurity Program Overview Oxford Funds has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists with the oversight of other third party service providers and their cybersecurity programs. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. Oxford Funds actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on Oxford Funds to engage external experts, including cybersecurity assessors and consultants to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on Oxford Funds' risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Officers and the expertise of risk management and information technology personnel of Oxford Funds when identifying and overseeing risks from cybersecurity threats, including risks from third parties.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from its Chief Compliance Officer ("CCO"), which incorporates updates provided by the Head of Information Technology of Oxford Funds, regarding the overall state of Oxford Funds' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the Head of Information Technology of Oxford Funds, manages the Company's cybersecurity program. The President and CCO of the Company oversee the Company's oversight function generally and rely on Oxford Funds' Head of Information Technology to manage the assessment and management of material risks from cybersecurity threats. The Head of Information Technology has more than 9 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for his oversight function as CCO to the Company for 9 years and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Oxford Funds.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: collect, use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information in the ordinary course of our business. As such, we leverage third-party information technology service providers who have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our information technology systems, including critical computer networks, third party hosted services, communications systems, hardware and software, and our data residing on these systems. Our Senior Vice President, Finance is responsible for overseeing these third-party service providers and processes.

companyName: Oruka Therapeutics, Inc.

ticker: ORKA


text: risks are identified by monitoring and evaluating our threat environment, and then assessed by various methods, for example, by manual and automated tools designed to identify and combat cybersecurity threats, analyzing reports of threats, conducting scans and assessments of the threat environment and to identify vulnerabilities, the use of detection and response services and conducting reviews of third-party service providers, among other things. Depending on the threat environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example, physical security and access controls, asset management, systems monitoring, incident detection and response, risk assessment, the implementation of security standards and certifications, encryption of data, network security controls, and a recovery/business continuity plan, among other mitigation tactics. Our recovery/business continuity plan is designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We plan to conduct due diligence on and audits of key technology vendors, contract research organizations, and other third-party contractors and suppliers. Additionally, we conduct periodic employee training that covers cyber and information security, among other topics.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management process. Our Senior Vice President, Finance, who reports directly to the Chief Executive Officer, together with our senior management, is responsible for assessing and managing cybersecurity risks with support from our third-party information technology service providers that employ information technology consultants with over 20 years of experience managing cybersecurity programs. Our cybersecurity program aligns to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and is consistently updated as NIST recommendations change year over year. Our Senior Vice President, Finance, together with our senior management and other employees works closely with our information technology service providers to evaluate material cybersecurity threats against our overall business objectives as part of our cybersecurity incident response. The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks. The Audit Committee has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President, Finance. The Board also receives updates from management and the Audit Committee on cybersecurity the last fiscal year, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. For a description of the risks from cybersecurity threats that may materially affect the Company and


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Cyngn Inc.

ticker: CYN


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management.


text: This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats. However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Keen Vision Acquisition Corp.

ticker: KVAC


text: Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes, and practices, which are integrated into the Company's overall risk management program. We have adopted aspects of the NIST cybersecurity framework, to which risk management in relation to our information systems is aligned. We categorize our information systems as either Tier 1 (critical) or Tier 2 or Tier 3 (essential), depending on business value and/or risk of financial or compliance impact of cybersecurity incidents. Our information security team uses a multifaceted approach to monitor, assess, identify, and manage material risks to the Company from cybersecurity threats, including testing of the effectiveness of our cybersecurity incident prevention and response systems; conducting routine vulnerability scanning of information systems assets; network/endpoint detection and response coupled with advanced identification-enhanced logging capabilities powered by artificial intelligence software; discovery through collaboration with the Company's internal audit team;

companyName: SB FINANCIAL GROUP, INC.

ticker: SBFG


text: monitoring of threat intelligence feeds provided by industry associations/groups, service providers, and federal/state authorities; and professional service engagements, such as retaining the services of an external 24/7 security operations center and partnering with third parties in testing our information systems for vulnerabilities from external, internal, and social engineering perspectives and assessing the effectiveness of our cybersecurity controls.


text: Company partners with third-party service providers and employs processes to assess, identify, and manage material risks from cybersecurity threats arising from the use of such third-party service providers. Our latest assessment attempted to identify vulnerabilities in our network and systems from external, internal, and social engineering perspectives. Our cybersecurity practices (including with respect to third-party service providers) have been assessed to represent a level of maturity consistent with industry best practices.


text: from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, and financial condition. For more information about these and other risks, see


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties.

companyName: Merlin, Inc.

ticker: MRLN


text: We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident.

companyName: COLOMBIER ACQUISITION CORP. II


text: As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target, such as GrabAGun, may have been subject to, or may in the future be subject to, cybersecurity incidents.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, as noted in Item 1A. Risk Factors of this Annual Report. Any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Annual Report.

companyName: BridgeBio Oncology Therapeutics, Inc.

ticker: BBOT


text: a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats.

companyName: JVSPAC Acquisition Corp.


text: However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties. Any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data.

companyName: AA Mission Acquisition Corp.


text: Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats.


text: Risk management and strategy rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: Ondas Inc.

ticker: ONDS


text: part of our broader risk management framework, we have identified the potential cybersecurity risks to our business and implemented structured controls to mitigate them. Our business applications and hosting services are designed to minimize the impact of cybersecurity incidents, enhance cybersecurity resilience, we have implemented a structured Information Security Management System (ISMS) certified in accordance with ISO 27001, providing a comprehensive approach to managing cybersecurity risks and aligning with industry best practices. Our risk mitigation efforts include a combination of administrative, technical, and operational controls, such as real-time monitoring and detection activities, anti-malware and endpoint protection solutions, annual employee cybersecurity training, regular security audits, third-party penetration testing, and a clear communication and reporting structure to facilitate timely responses to security incidents.


text: have a Cybersecurity Incident Response Plan (CIRP) that defines roles, responsibilities, and reporting mechanisms, as well as a structured incident response process covering preparation, detection, response, documentation, and post-incident analysis. This plan outlines possible cybersecurity threats and response measures for incidents such as denial-of-service attacks, malicious code attacks, website defacement, data corruption, and data leakage. In addition, we maintain a Business Continuity Plan (BCP) in accordance with ISO 27001 to ensure operational resilience, including detailed continuity procedures, system restoration timeframes, and recovery strategies for various scenarios.


text: address cybersecurity risks associated with third-party service providers, we have established procedures, policies, and tools for identifying, assessing, and mitigating potential threats. This process begins with a third-party risk assessment, which is performed and updated as needed. Our Information Security Guidelines for Suppliers ensure compliance with security standards, while our Access Control Policies regulate third-party access to sensitive systems, and our Cloud System Information Security Procedures govern data security in cloud environments.


text: We also engage third-party consultants to assist in designing and enhancing our cybersecurity risk management framework, including penetration testing and continuous threat monitoring. date, we have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Board of Directors has specific oversight responsibility for cybersecurity, which also oversees our general risk management. The Board of Directors reviews and discusses with management our policies, practices and risks related to information security and cybersecurity.


text: Chief Financial Officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. Leaders of our Ondas Networks and OAS segments, along with the Chief Financial Officer, meet quarterly to assess cybersecurity risks, identify emerging threats, and evaluate our risk management framework. The Chief Financial Officer provides quarterly updates to the Board of Directors on any cybersecurity-related risks. Our incident response plan includes notifying the Board of Directors of any material threats or incidents as they arise. Although these members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with in-house and third-party information technology specialists, enables them to effectively assess and manage material risks from cybersecurity threats.


text: OAS, risk management oversight is further managed through our Head of Information Security, who is responsible for overseeing the information security aspects of our cybersecurity framework. Our Head of Information Security brings extensive expertise to the role, with military experience in information security, a B.Sc. in Information Systems Engineering, and specialized training in computer and information systems security/information assurance from the T V S D Academy. Additionally, our Head of Information Security is certified by the Standards Institution of Israel as a Senior Internal Auditor for ISO 27001. Her areas of expertise include performing risk assessments, developing business continuity plans, drafting information security policies and procedures, conducting internal audits, leading information security training, and evaluating information systems structured approach ensures that our cybersecurity governance remains robust, proactive, and aligned with industry best practices.


text: Ondas Networks, risk management is further managed through the use of expert third party companies to assist in managing relevant risks.


text: In particular, the Company outsources its information technology function and monitoring to a third-party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third-party consultant.


text: Risk management and strategy Managing Material Risks & Integrated Overall Risk Management We have developed and continue to develop processes, including those intended to follow an internal Information Technology (IT) Security Policy, which seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we create, use, transmit, receive, and maintain. We also seek to integrate these processes and policies into our overall enterprise risk management system and processes. We also maintain an evolving cybersecurity roadmap for our future cybersecurity plans. The processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks. In furtherance of our cybersecurity policies and procedures, our IT team has a monthly IT Steering committee meeting, chaired by our Chief Financial Officer ("CFO") and Chief Strategy Officer, where all new IT projects include a cybersecurity component.

companyName: electroCore, Inc.

ticker: ECOR


text: Engage Third-parties on Risk Management We engage a range of external experts, including consultants, auditors, and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These partnerships are intended to give us access to specialized knowledge and insights that can inform our cybersecurity strategies and processes, including as to industry-standard control frameworks and applicable regulations, laws, and standards.


text: Oversee Third-party Risk As part of our evolving cybersecurity roadmap, we plan to implement and conduct security assessments of all third-party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.


text: Risks from Cybersecurity Threats We have not experienced any material cybersecurity incidents and the expenses we have incurred from any security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. See also "Risk Factors — Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business strategy and operating results." As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks.


text: Board of Directors Oversight Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Board's Audit Committee. The Audit Committee discusses with management not less than annually our major financial risk exposures, including those related to data privacy, data security and network security, and management's program to monitor, assess and control such exposures, including our risk assessment and risk management policies. The Audit Committee reports to the Board as necessary with respect to its activities, including making such reports and recommendations to the Board as it deems necessary and appropriate.


text: Risk Management Personnel Management's role in assessing, monitoring and managing our material cybersecurity risks is primarily the responsibility of our CISO, reporting to our CFO. Both the CISO and CFO rely on third party experts, including consultants, auditors, and cybersecurity assessors regarding cybersecurity strategies and processes. The CISO manages vendor work related to cybersecurity, and has primary responsibility for the evolving cybersecurity roadmap, remediating known risks, and leading our employee training program, pursuant to which we provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware and social engineering attacks), password hygiene, incident reporting process, as well as physical security best practices. Our management has also developed security policies and processes which include regular system updates and patches, employee training on cybersecurity and privacy requirements, incident reporting, and the use of encryption to secure sensitive information. In addition, we also regularly perform phishing tests of our employees and update our training plan at least annually. We maintain business continuity and disaster recovery capabilities to mitigate interruptions to critical information systems and/or the loss of data and services from the effects of natural or man-made disasters to our physical operations.


text: Monitor Cybersecurity Incidents The CISO implements and oversees processes for the regular monitoring of our IT systems. This includes the deployment of security measures to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO runs an incident response plan. This plan includes actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The CISO regularly informs the CFO of cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, which has oversight and may provide guidance on critical cybersecurity issues.


text: Management's Role Managing Risk The role of the Chief Information Security Officer (CISO) has been assigned to our VP, Information Technology, who has more than 20 years of IT experience and reports to the CFO. The CISO and the CFO inform the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on no less than an annual basis or on an ad hoc basis when needed. These briefings encompass: Evaluation of existing cybersecurity risks; Status of ongoing cybersecurity initiatives and strategies from the cybersecurity roadmap; and Incident reports and learnings from cybersecurity events.


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting companies similar to ours operating in the technology, software and identification space. All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our Board of directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective to prevent cyberattack incidents. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in cyberattack volume, frequency, and sophistication. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that as of the date of this Annual Report on Form 10-K, risks from prior cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: authID Inc.

ticker: AUID


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are based on frameworks established by the International Organization for Standardization, specifically ISO/IEC 27001:2013 and other applicable industry standards. We have established comprehensive Information Security Management Systems ("ISMS") policies, which are independently reviewed and audited annually for conformity and effectiveness under ISO/IEC 27001. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders, including a member of the Board meet at least monthly in our Security Steering Committee (the "Security Committee") to develop strategies for preserving the confidentiality, integrity and availability of our company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board and members of management. Risk assessment is integral to all engineering, business and operational decisions and in addition to the annual reviews, is an ongoing effort, as circumstances and facts arise.


text: At least annually we conduct a self-audit of our information security management systems ("ISMS"), in order to identify if there is any non-conformance with our ISMS policies and procedures. The results of the self-audit are reported to our Steering Committee and our external auditor for ISO/IEC 27001 compliance.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our employees, management and the Board on — our response to a cybersecurity incident.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding and contract renewal. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through regular privacy and security training and testing to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external independent auditors. These assessments include a variety of activities including information security assessments, audits and independent reviews of our ISMS, control environment and operating effectiveness. For example, in 2023 and 2024, we conducted independent audits to assess our ISMS against the ISO/IEC 27001:2013 standard and received certification of compliance with the standard. We also undertake regular penetration testing of our systems. The results of significant assessments are reported to management and the Board. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.


text: Our Board, in coordination with the Security Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Security Committee directly oversees our cybersecurity program. The Board receives periodic updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Our Chief Technology Officer ("CTO"), Senior Vice President of Engineering ("SVP-Engineering"), Data Engineering and Security Director and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of management's Security Committee, which is a governing body that drives alignment on security decisions across our company. The Security Committee meets monthly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.


text: Our CTO has served in various roles in information technology and information security for over 35 years, which have covered operations management experience in Government Security, Identity Access Management and SaaS solutions industries. Our SVP-Engineering has over 30 years of experience in software development and engineering, starting in the U.S. Marine Corps. Our Data Engineering and Security Director has over 10 years experience in information technology, with a focus on data engineering and information security. Our General Counsel has over 12 years of experience managing risks, including risks arising from cybersecurity threats, at several publicly-traded technology companies.


text: We recognize the critical importance of maintaining the trust and confidence of our customers, business partners, employees and other stakeholders. We engage in active oversight of cybersecurity, a cornerstone of our comprehensive enterprise risk management (ERM) program. Our cybersecurity framework is rooted in the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, as well as the International Organization for Standardization (ISO/IEC 27001), reflecting our commitment to uphold the highest cybersecurity standards. We align our policies, standards and practices with these benchmarks and dynamically refine them to address evolving cybersecurity threats.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Risk Management and Strategy We maintain a cybersecurity program aligned with NIST CSF standards designed to identify critical assets and vulnerabilities, protect them with appropriate safeguards, promptly detect cybersecurity events, respond effectively to mitigate their impact and recover from incidents to restore services. Our cybersecurity program is designed to safeguard the confidentiality, integrity and availability of information. Our cybersecurity risk management strategy includes: Governance: The Audit Committee of our Board of Directors oversees our cybersecurity risk management.


text: Our Chief Financial Officer and Director of Information Technology, along with key executives, have roles in governance and facilitating alignment across our organization.


text: Compliance and Standards: We design our cybersecurity program for compliance with industry-specific and other regulations (e.g., the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA)) demonstrating our commitment to both domestic and international information security standards.


text: Technical Safeguards We deploy technical defenses against cybersecurity risks of attack and other incidents, including firewalls, intrusion detection and prevention systems and access controls. We refine these measures based on our ongoing assessments, including cybersecurity threat intelligence updates.


text: Response and Recovery Planning: We maintain incident response and recovery frameworks, tested twice yearly through backup restorations to critical systems, to improve our preparedness to effectively manage and mitigate cybersecurity incidents.


text: Education and Awareness: Our personnel and members of our Board of Directors undergo mandatory periodic training on cybersecurity threats, with updated insights into effective defense mechanisms and our evolving cybersecurity policies and practices.


text: Use of Third Parties: We collaborate with external cybersecurity service providers, including auditors, consultants and governmental agencies, to refine our cybersecurity measures. These service providers carry out cybersecurity risk evaluations such as periodic assessments and vulnerability scans to pinpoint potential security flaws and suggest enhancements. In addition, we employ third-party technology and other solutions to enhance our protection against cybersecurity risks. These solutions include our use of a managed security service provider to support our in-house technology team, an endpoint detection and response, or EDR, system for ongoing surveillance, detection, and action against threats, as well as a security information and event management, or SIEM, system designed to automate the real time identification, investigation and prioritization of critical alerts.


text: Third-Party Risk Management: We use a comprehensive due diligence process to manage third-party risks, emphasizing continuous monitoring and to ensure our business partners' cybersecurity practices meet our stringent standards.


text: As of the filing of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect, Alto Ingredients, Inc.


text: We take a comprehensive and forward-looking approach to cybersecurity risk management under the oversight of our Audit Committee. Management, including our Chief Financial Officer and our Director of Information Technology, provide regular updates to ensure a strategic, unified response to cybersecurity challenges. Management is notified of, and monitors, cybersecurity incidents through our EDR and SIEM systems.


text: Our Director of Information Technology has over 20 years of experience in information technology and five years of experience serving directly as a Chief Information Security Officer for other organizations.


text: networks and systems are continuously monitored by a combination of third-party service providers and an internal cybersecurity team. Management is promptly notified of cybersecurity incidents. Audit Committee is promptly notified by our management of any material cybersecurity breach. Board of Directors is briefed at least quarterly on the state of our cybersecurity program.


text: internal cybersecurity team collaborates with external cybersecurity service providers, including auditors, consultants and governmental agencies, to refine our cybersecurity measures. These service providers carry out cybersecurity risk evaluations such as periodic assessments and vulnerability scans to pinpoint potential security flaws and suggest enhancements.


text: Engagement and Continuous Improvement We periodically evaluate our cybersecurity measures through internal and external audits and assessments to ensure our cybersecurity program is at the forefront of industry best practices.


text: The results of these audits and assessments inform adjustments to our cybersecurity program to improve our resilience against emerging cybersecurity threats.


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Cadrenal Therapeutics, Inc.

ticker: CVKD


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Cadrenal's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on Cadrenal's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Cadrenal acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: the ordinary course of our business, we receive, process, use, store and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary and personal information. We depend largely upon our information technology systems in the conduct of all aspects of our operations. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: To this end, we have implemented processes and systems designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems to prevent adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.


text: 2024, we did not identify any cybersecurity breaches that materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: management team is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity incidents. Our chief technology officer has over 41 years of experience and has held various leadership roles in information technology, including serving as a chief information officer and chief technology officer for the last 13 years. He has successfully implemented and managed large enterprise resource planning systems, e-commerce websites, stores and enterprise infrastructure, both cloud-based and on-premise. His expertise extends to evaluating and hiring cybersecurity personnel and outsourced managed services, defining incident response plans, conducting tabletop exercises, and establishing communication protocols with internal executives, board members, and vendors. He has firsthand experience in responding to actual cybersecurity incidents, showcasing a deep understanding of the challenges and complexities within the cybersecurity landscape in the retail sector. Our senior director of cybersecurity and compliance has a 16-year track record as an information technology and information security professional, complemented by an Executive MBA. His career is distinguished by a decade of leadership as the commander of the United States Army cyber protection team (174 CPT), where he gained cybersecurity experience at USCYBERCOM and ARCYBER.


text: He holds multiple professional certifications, including CISSP, PMP and multiple SANS certifications. Our chief technology officer and senior director of cybersecurity and compliance report to the Audit Committee on these matters. maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.


text: Our cybersecurity risk management processes are being integrated into our overall risk management processes. We are making efforts to incorporate cybersecurity considerations as a part of our business processes. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. For example, a comprehensive cyber risk assessment, both physical and logical, was conducted by a third party, serving as an external penetration test to validate our security posture. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. Additionally, we have established a Technology Review Committee ("TRC") tasked with the role of evaluating new software tools and technologies before their implementation. The TRC consists of experts from various domains within our organization, including information technology security, compliance, legal, and operations. This TRC conducts assessments to ensure that any new software tools meet our standards for security, compliance and operational efficiency.


text: oversight of our cybersecurity is assigned to the Audit Committee of our Board of Directors. The Audit Committee receives regular reports and briefings from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks.


text: In addition, management updates the Audit Committee as necessary regarding any material cybersecurity incidents as well as any incidents with lesser impact potential. The Audit Committee received one report from our Senior Director of Cybersecurity and Compliance in 2024.


text: are a shell company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software in. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with. We may the future determine to engage an assessor(s), consultant(s), auditor(s) or other third party (s) to supplement our processes.

companyName: Allegro Merger Corp.


text: date, we have not experienced any cybersecurity attacks. However, any such attack could adversely affect our business. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Horizon recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Managing Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: we are aware of the risks associated with third-party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. At a minimum the monitoring includes annual assessments by our Chief Information Security Officer ("CISO"). This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence, Board of Directors Oversight Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.


text: The Audit Committee is composed of independent board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: CISO and our Chief Executive Officer play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and learnings from any cybersecurity events; and addition to our scheduled meetings, the Audit Committee, CISO and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated our broader strategic objectives. The Audit Committee conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: responsibility for assessing, monitoring, and managing our cybersecurity risks rests with the CISO, Jason O'Neill. With over 25 years of experience in the field of IT Technology and enterprise security, Mr. O'Neill brings a wealth of expertise to his role.


text: His background includes extensive experience achieving bank and government-level compliant security practices in high-performance technology companies. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, communicates cyber security threats, remediates known risks, and oversees our employee training program.


text: CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: to company files and data is critical to our effective operation and financial performance. The Company is aware that cybersecurity treats including ransomware must be identified and mitigated with minimal impact to corporate objectives. We employ a secure data governance policy that includes off-site, secure, multi-cloud data storage to ensure that risks to critical business operations are mitigated in the rare case of an incident.


text: CISO, in his capacity, regularly informs the Chief Financial Officer and Chief Executive Officer of all aspects related to cybersecurity risks and incidents. This ensures that the senior management team is kept abreast of the cybersecurity posture and potential risks facing New Horizon. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: have taken a multifaceted approach to addressing cybersecurity risks, including leadership from our senior management and Board of Directors, direct supervision and operational execution from our information technology ("IT") department and active involvement of employees. The Company's senior management devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. We periodically assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our IT team reviews cybersecurity risks, and we have a set of Company-wide policies and procedures concerning cybersecurity matters, including policies related to encryption standards, remote access, multi factor authentication, confidential information, the use of the internet, social media, email and wireless devices and incident response.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Company's Chief Executive Officer is responsible for developing and implementing our information security measures and overseeing our IT department. The Company has established a physical firewall, with physical gateways that filter suspicious files and data flows entering and exiting our Company's network. In addition, the computers in our R&D department are equipped with behavior control software, which makes emails and files sent from the R&D computers in an encrypted state and inaccessible without specific authorization from designated supervisors.


text: Company's IT department is directly responsible for cybersecurity matters and routinely reports to the senior management. In the event of a cybersecurity incident, the IT department will initially report to the Company's senior management, including our Chief Executive Officer. If the incident is assessed as a material threat or incident to our information systems, our senior management will escalate the issue to the Board of Directors. Given that our core operations are in manufacturing and involve limited network-related activities, we believe that our existing cybersecurity measures are adequate. The Company's Board of Directors and senior management are committed to continuously evaluating and upgrading our cybersecurity prevention, detection, and mitigation strategies in line with the evolution of our business needs and cybersecurity risks.


text: the fiscal year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: For additional information about these risks, see " Risks Related to Our Business—We rely significantly on technology and systems to support our production, supply chain, payments, financial reporting and other key aspects of our business. Any failure, inadequacy, interruption or security failure of those systems could have a material adverse effect on our business, reputation and brand, financial condition, and results of operations " and " Risks Related to Our Business—System security risk issues, and disruption of our internal operations or information technology systems, could have a material adverse effect on our business, financial condition, and results of operations " in Item 1A-Risk Factors.


text: Health In Tech prioritizes a proactive and comprehensive approach to risk management and cybersecurity, ensuring the protection of our Operational Technology (OT) environment and critical infrastructure from evolving cyber threats. Our security framework is built on robust, adaptive measures, which are regularly refined to incorporate industry best practices and cutting-edge technologies.

companyName: Health In Tech, Inc.

ticker: HIT


text: Through strategic oversight, advanced threat detection, and frequent improvement, we maintain a high level of protection for our systems and data.


text: Below is an overview of our processes for assessing, identifying, and managing material risks from cybersecurity threats, all of which are conducted in-house.


text: Network/System Security of OT from IT and User Networks: We ensure our OT systems are physically or logically separated from corporate IT networks, reducing the risk of cross-contamination. Device Hardening: We enhance security by disabling unnecessary ports, services, and protocols, minimizing potential attack surfaces. ensure data Encryption in transit and at rest.


text: Management: We maintain a controlled patch management process, ensuring OT systems receive regular updates while considering their unique conduct continuous vulnerability scanning to internal and external networks.


text: Protection: We implement best-practice security baselines and hardening measures, supported by next-generation security agents EDR for monitoring and automated remediation. Additionally, our Security Information and Event Management (SIEM) system enables autonomous remediation and real-time threat alerting our security team.


text: Solutions: Recognizing that traditional antivirus may not always be applicable, we deploy specialized security software to detect and prevent malware threats.


text: Analysis: We utilize advanced behavioral analysis tools to detect ransomware threats by identifying unusual encryption activity, unauthorized file modifications, and abnormal network communications.


text: Backup and Recovery: We perform regular backups of critical systems, ensuring they are securely isolated from the production environment to safeguard against ransomware attacks. Additionally, our disaster recovery plans undergo routine testing of backups to ensure rapid and effective recovery when needed.


text: of Least Privilege (PoLP): We enforce strict access controls, granting system access only to individuals who require it for their roles. Regular audits ensure compliance and minimize security risks.


text: Authentication (MFA): We require MFA for all system access, adding an extra layer of security to protect against unauthorized access.


text: Access Control (RBAC): Access to sensitive systems is governed by users' roles, ensuring only authorized personnel can perform specific actions on critical systems with regular user access audits.


text: Secure Remote Access and secure tunneling: We utilize secure VPNs and tunneling technologies with strong encryption to protect remote access to our systems. These connections are continuously monitored to ensure security and integrity.


text: Incident Response and Recovery Plans have a comprehensive incident response plan with detailed procedures for addressing ransomware attacks and other cyber threats, in an effort to provide a swift and effective response. Coordination: Our IT and security teams collaborate seamlessly during incidents to respond quickly, contain threats, and minimize impact.


text: Security Audits and Risk Assessments security audits: We conduct frequent security audits and vulnerability assessments to identify potential weaknesses and keep our defenses up to date. Additionally, we engage a third-party penetration testing firm for annual assessments to identify and address security vulnerabilities/misconfigurations.


text: risk management: We regularly evaluate and adapt our security measures to respond to emerging threats, including new ransomware strains and the evolving cyber threat landscape. incorporate threat intelligence into our security operations to proactively identify and mitigate potential cyber risks.


text: Employee and Contractor Required Training and Awareness cybersecurity awareness training, encompassing phishing awareness and sensitive data handling, is required for all employees and contractors. In addition, all IT and IT security staff are required to complete secure coding and data hygiene training. conduct simulated phishing tests monthly with required retraining on any failures.


text: exercises: We regularly run simulated attack exercises to ensure our teams are prepared to act swiftly and effectively during an actual cyberattack. Risk Management and Oversight Committee We conduct comprehensive risk assessments to identify vulnerabilities across systems, processes, and third-party dependencies.