text: Risk management in software development involves identifying, assessing, and mitigating risks that could impact the project's success. This strategy begins with a thorough risk identification process, where potential issues such as technical challenges, project scope changes, and resource constraints are recognized early. Each risk is then assessed for its probability of occurrence and potential impact on the project. Based on this assessment, risk mitigation strategies are developed and implemented. These strategies might include adopting flexible project management methodologies like Agile, investing in training for team members, implementing robust testing and quality assurance processes, and maintaining open communication channels with all stakeholders. Additionally, regular risk reviews are conducted throughout the project lifecycle to ensure that new risks are identified and managed promptly.


text: The Company's' Cybersecurity Policies are updated annually and reviewed by Independent 3rd Party Vendors to certify compliance. The Company requires Cybersecurity Awareness training for all new hires and a minimum of an annual review of such policies for all employees. The Company created and deployed an extensive Learning Management System that tracks employee adherence to Cyber Security Awareness, HIPAA and other related content. The Company's' Cybersecurity Incident Response Policy provides specific steps for any employee that detects an attack to take to help stop the propagation of the threat and report the incident to their Superiors, the IT Team and the Security Manager.

companyName: iCoreConnect Inc.

secItem: Item 1C


text: While there are significant threats of all types in the modern connected world, studies show that phishing attacks and social engineering through email and other electronic means are of high concern. With the vast majority (some say as high as 95%) of such attacks originating via email, employee education on how to identify and handle suspicious email and other forms of communication is critical in protecting the data and infrastructure.


text: To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition.


text: The Board is responsible for general risk oversight. The Board reviews and evaluates management's evaluation and mitigation of cyber risks as part of its oversight of the Company's Risk Management program. Management periodically reviews cyber risks, incidents, and risk mitigation plans and activities with the Board.


text: We engaged an outside consulting firm to conduct a review of our information systems environment and make recommendations to improve security where appropriate. Management shared the report's findings with the Board and periodically updates the Board regarding our progress on implementing the report's recommendations.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats for our Company, if any, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Corner Growth Acquisition Corp.


companyName: CORNER GROWTH ACQUISITION CORP. 2


text: As of the date of this Annual Report, we have not yet adopted a formal, written cybersecurity risk management policy or enterprise-wide cybersecurity governance framework. However, we are aware of the growing risks associated with cybersecurity threats and are in the early stages of assessing and developing appropriate controls to identify and mitigate such risks in proportion to our size, scale, and operational complexity. We intend to implement a formal cybersecurity risk assessment and governance policy by Q4 2025. This process will include third-party vendor risk assessment, incident response protocols, and reporting mechanisms to management and the sole director.

companyName: Arculus System Co., Ltd.

ticker: AQLS


text: Risk management and strategy While we do not currently have dedicated cybersecurity personnel or a Chief Information Security Officer (CISO), responsibility for cybersecurity-related matters currently resides with our senior management team. Management oversees the implementation of basic safeguards, including secure login credentials, limited network access, and offsite data backups. We rely on third-party cloud-based software and IT vendors for the majority of our infrastructure and data storage, and we depend on their built-in security protocols.


text: We have not yet experienced any known material cybersecurity incidents. However, the lack of a formal cybersecurity risk management framework may expose us to vulnerabilities that could have an adverse effect on our operations, financial position, or reputation if not appropriately addressed in the future. We are currently evaluating the need for a more structured cybersecurity program and anticipate allocating resources to strengthen our risk management processes as we grow.


text: Cybersecurity oversight is provided by our executive officers, who periodically review cybersecurity considerations as part of their general oversight of business operations and IT needs. The Board of Directors has not yet established a dedicated cybersecurity committee or delegated specific oversight responsibility to an existing committee. Cybersecurity risks, to the extent material, are discussed by management with the Board on an ad hoc basis.


text: Our management team is responsible for monitoring industry trends, consulting with outside IT vendors, and taking basic steps to protect company systems and data. Although none of our executive officers have formal cybersecurity credentials, we recognize the importance of increasing our capabilities in this area as we scale our operations and infrastructure.


text: Risk Management and Strategy We do not have any processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Agentix Corp.

ticker: AGTX


text: Risks from Cybersecurity Threats To date, we have not yet experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, financial condition or results of operations.


text: Our board of directors (the "Board") is acutely aware of the critical nature of managing risks associated with cybersecurity threats given the significance of these threats to our operational integrity and stakeholder confidence.


text: The Board has oversight of cybersecurity risks and bears the primary responsibility for this domain. The members of our Board do not have experience in enterprise risk management, compliance, corporate governance, technology, or finance to equipping them to oversee cybersecurity risks effectively.


text: Given the size of our company and the nature of our operations, we do not believe that we face significant cybersecurity risk.

companyName: BIOETHICS LTD

ticker: BOTH


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We utilize standard commercial software for business operations, which includes basic security features such as password protection and data encryption. Our management is generally responsible for assessing and managing any cybersecurity threats.


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further actions, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate to take.


text: Cybersecurity Risk Management and Strategy Due to the size of the Company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We and our subsidiaries currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate.

companyName: SinglePoint Inc.

ticker: SING


text: We intend to work with outside counsel and third party service providers in the near term to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report. We maintain a cyber liability insurance policy. However, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above.


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.


text: At present the Company has minimal risk related to Cybersecurity as no operational business is conducted on the internet or available through the internet.

companyName: ADVANCED OXYGEN TECHNOLOGIES INC

ticker: AOXY


text: Cybersecurity risk management will be an integral part of our overall enterprise risk management efforts once the Company has determined how and what security measures will need to be deployed. No enterprise risk can be eliminated entirely. We will seek to mitigate as much risk as possible and manage the remaining financial risk internally.


text: Our Board of Directors has primary responsibility for evaluating cybersecurity risk management, overseeing our major cybersecurity risk exposures and the steps management has taken to monitor and control these exposures, including policies and procedures for assessing and managing risk, as well as oversight of compliance related to legal and regulatory exposure.


text: The "to be newly formed" management positions responsible for assessing and managing cybersecurity risks will be a Director of Cybersecurity and a Chief Information Officer ("CIO"), who will report directly to our CFO. Presently our CFO is undertaking the actions of both the Director of Cybersecurity and CIO. The CIO will be responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy.


text: We are committed to using technology to improve our competitive position. We depend on a variety of information systems and technologies (including cloud technologies) to manage the operations of our growing customer base. Our core business systems consist mostly of purchased and licensed software programs that integrate together and with our APP.

companyName: Karbon-X Corp.

ticker: KARX


text: We manage data security and privacy at the highest levels. Our Chief Executive Officer (CEO) is actively engaged in oversight of cybersecurity and IT infrastructure and works with outsourced vendors to manage all network operations. Our vendors keep our CEO informed on cybersecurity and privacy matters throughout the year. We have strengthened our data protection capabilities through investments in our infrastructure hardware and software. During the fiscal year ended May 31, 2025, the Company did not experience any material cybersecurity incidents.


text: Given the limited nature of its operations and reliance on third-party service providers for professional services, the Company has concluded that it is not materially exposed to cybersecurity threats. To date, the Company has not experienced, nor does it anticipate, any cybersecurity incidents that would materially affect its business, financial condition, or results of operations.


text: The Board of Directors is responsible for oversight of the Company's cybersecurity risk. In fulfilling this role, the Board receives updates from the Chief Executive Officer, who, with the assistance of external legal and accounting professionals, monitors any potential cybersecurity matters and reports to the Board as necessary.


text: Cybersecurity risks are overseen by the full Board of Directors and the Audit Committee as part of their regular oversight. Members of the Board and Audit Committee are encouraged to engage in ad hoc conversations with management on cybersecurity related updates to our risk management and strategy. Cybersecurity incidents are reported to the Chief Financial Officer to determine incident severity and response. In an effort to deter and detect cyber threats, we also provide all employees with access to digital assets with an ongoing cybersecurity awareness training program, which further educates employees and covers timely and relevant topics, including phishing, password protection, asset use and mobile security.

companyName: UPEXI, INC.

ticker: UPXI


text: The Company has established processes to assess, identify, and manage material risks from cybersecurity threats as part of its overall enterprise risk management system. Its cybersecurity processes include security monitoring and detection through third-party vendors. The processes also extend to oversight and identification of risks associated with vendors and customers if their computer systems interface with the Company's information systems. Upon detection of a potentially material cybersecurity incident, the Company initiates its cyber incident procedure to investigate, contain, and remediate the incident.


text: The Company has not experienced any material cybersecurity incidents, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to the Company, including potentially to the Company's results of operations and financial condition. The Company relies extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that the Company may expend greater resources to continue to modify and enhance protective measures against such security risks.


text: The Custodians are responsible for safekeeping all of the SOL owned by the Company. We maintain multiple Custodians to reduce the risk of a single failure and we plan to expand to additional custodians as our Treasury grows. The Custodian accounts are all opened by the Company, this segregates our assets into an individual custodian account owned by the Company and access is monitored and controlled by the Company. Our Asset Management Company is given access to the Custodian accounts with established controls to ensure transactions require consensus of a minimum of two individuals when assets are being transferred between wallets and additional controls if an asset of the Treasury is moved out of the Custodians control. The assets go through the Custodians Trust Company, which maintains its own insurance and is regulated by their respective state where the trust is incorporated in.


text: Our primary custodian is currently BitGo Trust Company, Inc. a South Dakota corporation ("BitGo") and is regulated by the state of South Dakota. On May 1, 2025, we entered into a Custodial Services Agreement with BitGo (the "BitGo Agreement") to hold our digital currency. The term of the BitGo Agreement is for one year with successive one-year renewals unless prior notice of non-renewal is given by either party. The Company pays BitGo a monthly digital asset storage fee based upon the market value of the assets in storage, plus $500. The BitGo Agreement is terminable by either the Company or BitGo on thirty days' notice as a result of a breach of the Agreement and may be suspended by BitGo if the Company violates the intended use of the account or due to a change in the applicable law, litigation or bankruptcy.


text: Our secondary custodian is Coinbase Inc., a subsidiary of Coinbase Global, Inc., a Delaware corporation, which is primarily used for the acquisition of digital assets. On May 5, 2025, the Company entered into an Institutional Client Agreement with Coinbase (the "Coinbase Agreement"). The Coinbase Agreement is terminable at will by either the Company or Coinbase. The Company pays Coinbase its regularly scheduled fees based on the dollar trading volume over a thirty-day period. The Coinbase Agreement is terminable by either the Company or Coinbase on ten days' notice as a result of a breach of the Agreement and may be suspended by Coinbase if the Company violates the intended use of the account or due to a change in the applicable law, governmental proceeding, litigation or bankruptcy. Coinbase may also close the Company's account if it has been inactive for more than one year.


text: BitGo maintains a $250,000,000 policy against loss, theft and misuse. Currently we have approximately $253,000,000 of treasury value at Bitgo, based on the SOL price of $202.51 per token. Coinbase has an insurance policy for any cash held in the account of $250,000. We currently have less than $250,000 of cash held at Coinbase and less than $6,000,000 in SOL value, based on the SOL price of $202.51 per token. At the current price of SOL as of the date of this report, these policies are not adequate to fully cover the full loss of our SOL.


text: Solana, as with all digital assets, can be highly volatile. Management reviews the account balances and the total value held with a custodians to allocate the Company's holdings between multiple accounts and custodians to mitigate risk. We do not use self-storage for any of the SOL treasury assets.


text: Private keys are generated by the Custodian in key generation ceremonies at secure locations using offline devices that have never been connected to a network. Private keys are generated according to detailed procedures using specialized offline devices and within these secure facilities to mitigate risk of hacks, errors, or other unintended external exposure. Key ceremony processes are highly controlled, require segregation of duties across multiple parties and are reviewed and witnessed by designated oversight personnel. Thorough validations and signoffs are performed to verify the integrity and security of key generation ceremonies.


text: The Custodians hold a majority of SOL in cold storage and provides a user interface for the Company to manage the allocation of SOL between cold and hot storage for the wallets. The Company maintains more than 98% of its SOL treasury in cold wallets.


text: The Custodians have multiple, redundant cold storage sites, which are geographically distributed including sites within the United States. Cold storage locations of the Custodian are monitored by 24x7 on-site security, video surveillance and alarms, hardened room structures, and access to these facilities is controlled by multi-person controls, multi-team access rules, and multi-factor authentication. The locations of the cold storage sites may change at the discretion of the Custodian and are kept confidential by the Custodian for security purposes. Transactions from cold to hot storage require physical access, according to the above controls, to one or more cold storage facilities, as well as systematically enforced approvals and integrity verifications, before the secure device can be used to cryptographically complete the transaction. At no point during this process is the private key removed from the secure device(s) nor the cold storage facility. Once these security processes have been completed, a transfer on the Solana network can be executed, as signed using the private keys held offline in cold storage.


text: The Custodians also maintain geographically dispersed backups of private keys, which are cryptographically generated into shards and stored in separate locations; multiple locations must be accessed to reconstruct a single key. The storage facilities are highly secured, and include 24x7 on-premises security presence, video surveillance, and alarms for unexpected entry. Access to facilities is controlled by multi-person controls, multi- team access rules, and multi-factor authentication.


text: All of our Custodians have SOC type 2 reports that the Company has reviewed and we get regular bridge reports from our Custodians to help ensure the controls are being maintained. Our Custodians maintain their own insurance policies to cover our loss, which is in addition to the policies that we maintain ourselves. We currently have two qualified Custodians that we have approved for our treasury use and we are in the process of onboarding a third as part of our risk management process.


text: The Company is charged for storage fees, staking fees and transaction fees for services specifically requested by the Company or the Asset Management Company. Except as set forth above, the contract terms of the agreements are typically for one to three years and can be terminated upon 30 day notice and payment of all fees due and one month of additional fees.


text: As of July 31, 2025, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: Independence Power Holdings, Inc.

ticker: ITXP


text: Cybersecurity risk management is part of the Company's overall risk management. Our cybersecurity risk management is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third party service providers. Our primary third party service providers, utilize two (2) factor authorization as well as login and password protections with email verifications.

companyName: Tech Tonic Group Corp.

ticker: THTG


text: Our Board has overall oversight responsibility for our risk management, including our cybersecurity risk management. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored. We have not experienced any cybersecurity incidents in fiscal year 2025.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.


text: Risks related to Cybersecurity Incidents We face significant risks related to cybersecurity threats, which could adversely affect our business, financial condition, and results of operations. Cybersecurity incidents, including but not limited to unauthorized access, data breaches, and other malicious activities, could result in the loss or theft of sensitive information, disruption of our operations, and damage to our reputation. While we have implemented measures to protect our information systems, there can be no assurance that these measures will effectively prevent all cybersecurity incidents.

companyName: LEAFBUYER TECHNOLOGIES, INC.

ticker: LBUY


text: Data Breaches: A breach of our information systems could lead to unauthorized access to customer or employee data, resulting in reputational harm and legal liabilities. Operational Disruption: Cybersecurity incidents could disrupt our operations, leading to delays in production, delivery, or fulfillment of customer orders.


text: Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, impacting our competitive position in the market.


text: Regulatory and Legal Compliance: Cybersecurity incidents may subject us to regulatory investigations, legal claims, and penalties, affecting our compliance with applicable laws and regulations.


text: Third-Party Relationships: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations.


text: Although, to date, cybersecurity incidents have not materially impacted our business strategy, results of operations, or financial condition, there can be no assurances that they will not do so in the future. Refer to "Item 1A. Risk factors" in this Annual Report for additional information about cybersecurity-related risks.


text: Risk Management and Strategy Assessing, Identifying, and Managing Material Cyber Threats We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy. We use a team of outside vendors and government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and AI-based user behavior analytics also support identification and management of cyber threats. Response to a broad category of threats is immediate and automatic. Security personnel and members of our management are alerted when cyber threats or anomalies are detected. Persistent threats or issues that, in the opinion of management, are material are immediately brought to the attention of our board of directors.


text: In the event of a detected cyber incident by 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment of the incident, identifies the source of the problem, and resolves the issue as appropriate. If they are unable to resolve the issue, the problem is escalated to our cybersecurity monitoring and detection software provider for resolution. Events which are not routinely resolved by our IT and cybersecurity provider are brought to the attention of the board.


text: In order to mitigate risks of cybersecurity incidents, critical business and operational data are backed up at night and stored offsite for security purposes and to restore data in the event of a breach. Additionally, we provide cybersecurity awareness training of our employees, incident response personnel, and senior management.


text: Our executive management team is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises both our internal cybersecurity and IT related personnel, as well as our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our board of directors provides oversight and oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Two of our management have received training on cyber risk governance for public companies, regularly brief our board of directors on our cybersecurity and information security posture as well as cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the board's involvement in cybersecurity governance ensures that we are adequately focused on resources and protecting the Company's assets and reputation.


text: Risk Management and Strategy Our cybersecurity policies, standards, processes, and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Blackwell 3D Construction Corp.

ticker: BDCC


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our Board of Directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our Chief Executive Officer, who is assigned oversight of cybersecurity risks. Our Chief Executive Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: We regularly review our cybersecurity defenses to assess our vulnerability to cybersecurity attacks from viruses, malware and more sophisticated and targeted cyber-related attacks such as hackers looking to demand ransomware or access our systems to obtain information and data, as well as our vulnerability to cybersecurity failures resulting from human error and technological errors. We rely upon internal IT personnel working in conjunction with specialized outside security consultants on a day-to-day basis to conduct reviews and upgrade our systems when determined to be necessary.

companyName: MedWellAI, Inc.

ticker: MWAI


text: Our overall strategy in combatting cybersecurity risks includes a variety of measures, including: the use of antivirus software, virtual private networks, email security, as well as other software and system-wide measures such as multi-factor authorization to prevent and detect data intrusions;


text: deployment of updates and patches as they become available from our software suppliers and consultants and maintaining the current versions of major software to reduce the exposure to vulnerabilities; the use of third-party services to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security risks;


text: the review of the security procedures used by third parties that may host or otherwise have access to our systems;


text: the deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and systems in an effort to identify potential vulnerabilities; and consideration of the cybersecurity risks posed by interacting with current and potential third-party service providers, suppliers and customers.


text: We are not aware of any existent weakness in our systems or malware embedded in our systems that would materially affect, or are reasonably likely to materially affect, our operations.


text: The Board, as a whole, has oversight responsibility for our strategic and operational risks. The Board is responsible for oversight of our efforts to eliminate cybersecurity risks. The Board meets regularly with our Chief Executive Officer and Chief Financial Officer.


text: Risk Management and Security The Company's Cybersecurity Policy outlines our guidelines and provisions for preserving the security of our data and technology infrastructure. The more the Company relies on technology to collect, store and manage information, the more vulnerable to severe security breaches the Company becomes. Human errors, hacker attacks and system malfunctions could cause significant financial damage and may jeopardize the Company's reputation. For this reason, the Company has implemented extensive security measures, has prepared instructions in order to mitigate security risks, and has outlined both provisions in this policy.

companyName: XERIANT, INC.

ticker: XERI


text: Our Board of Directors oversees our risk management, including our information and cybersecurity policies and risk assessments. Our management reports to our Board of Directors on information security as necessary, regarding any significant cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. Our risk management, legal, and compliance personnel oversee and identify material risks from cybersecurity threats.

companyName: Artisan Consumer Goods, Inc.

ticker: ARRT


text: We have not identified risks from known cybersecurity threats, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks.


text: We rely upon internally and externally managed information technology systems for the collection and storage of sensitive data and business information. We approach cybersecurity risks with a risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to our business.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: Risk Management and Strategy Our cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect our information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned or managed by us. Our focus is on protecting sensitive information, such as personal information of our customers and employees, and confidential business information that could be leveraged by a competitor or a malicious actor.


text: Our cybersecurity program has several components, including the adoption of information security protocols, standards, and guidelines consistent with best industry practices; engaging third-party service providers to conduct security assessments and penetration testing; and performing periodic internal audits of our cybersecurity protocols. We employ a risk-based process designed to manage cybersecurity risks presented by third-party vendors that may have access to our sensitive information and/or information technology ("IT") systems. This process may consider the nature of the services provided, the sensitivity and quantity of information processed, the criticality of any potentially impacted IT systems, and/or the strength of the vendor's cybersecurity practices.


text: We monitor potential cybersecurity risks through tracking. These key risks are characterized by various factors such as the likelihood of us experiencing a particular type of cybersecurity incident, the speed at which each type of cybersecurity incident could impact the Company, and management's assessment of the Company's ability to respond quickly and efficiently.


text: An incident response plan aligned with best practices guidelines governs our response to cybersecurity incidents. The incident response plan outlines how we can detect, analyze, contain, eradicate, recover, and perform post-incident activities in the event of a cybersecurity incident. It also contains an internal, risk-based escalation framework designed to ensure that all relevant individuals are promptly informed of any cybersecurity incident and dictates procedures for determining whether a cybersecurity incident is material without unreasonable delay.


text: Material Effects from Risks of Cybersecurity Threats While we may experience minor data and cybersecurity incidents from time to time, to our knowledge, the risks posed by cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. However, there can be no assurance that we will not be materially affected by such risks in the future. A successful cybersecurity attack may expose us to misuse of information or systems, the compromising of confidential information, manipulation or destruction of data, production downtimes, and operations disruptions.


text: Role of Management One of the key functions of our executive officers is to inform oversight of our risk management process, which includes risks from cybersecurity threats. Our executive officer monitor and assesses strategic risk exposure, and manages the material risks we face.


text: Our Chief Executive Officer works to manage our cybersecurity policies and processes. He is responsible for managing how we identify, address, prevent and resolve cybersecurity issues and related matters. He is also responsible for tracking how we prevent, identify, lessen, and address cybersecurity issues. This is done through regular checks of our systems, tests to identify security weaknesses, and maintaining an incident response plan.


text: Risk management and strategy Management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes and is monitored as an enterprise risk. To that extent, the Company has not currently engaged with a third-party service provider for the purpose of managing its ongoing cybersecurity risk. Furthermore, the Company is currently putting processes in place in order to oversee and identify risks from cybersecurity threats associated with The Company employs a full time, degreed internet and technologies engineer, Matthew Bellestri, as its Director of Internet and Security Services. The Company entered into a three (3) year employment agreement with Mr. Bellestri as of February 1, 2025. Mr. Bellestri has also been nominated to serve on the Company's Executive Committee that reports to the Company Board of Directors.

companyName: flooidCX Corp.


text: The Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: The Board of Directors now has formal oversight of risks from cybersecurity threats. At the end of 2024, it is important to note that, as discussed in Part III of this filing, our Board of Directors was comprised solely of Messrs. Danzik, Kitchen and Westbrook. As such, pursuant to the information provided below, all risks from cybersecurity threats our immediately shared with the Board of Directors.


text: In the ordinary course of our business, we are subject to cybersecurity threats and risk which it manages as an important component of its overall enterprise risk management strategy. We store and process data for our customers, employees, partners and suppliers. We have not yet implemented a formal cybersecurity risk management program designed to identify, assess and mitigate risks from cybersecurity threats to this data, our systems and business operations. We intend to implement a cybersecurity risk management program before the end of 2025.

companyName: T-REX Acquisition Corp.

ticker: TRXA


text: Cyber Risk Management and Strategy Under the oversight of our Audit Committee, we intend to implement and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes would be integrated into our overall risk management processes. We intend to implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. In support of this approach, it is expected that we would have a third-party security consultant implement processes to assess, identify and manage security risks to our company, including in the pillar areas of security and compliance, application security, infrastructure security and data privacy. This process, once implemented, would include regular compliance and critical system access reviews. In addition, we intend to conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments as part of our risk management process. We expect to utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We intend to utilize well-known cloud-based technologies and service providers, such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.


text: Further, we intend to put processes in place that would evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that would have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring.


text: Part of our intended program would be ongoing evaluation and enhancement of our systems, controls and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition.


text: Risk Management and Strategy Our cybersecurity policies, standards, processes, and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Quantum Genesis AI Corp.

ticker: QTZM


text: No material cybersecurity incidents were identified as of filing date. We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our Board of Directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our Chief Executive Officer, who is assigned oversight of cybersecurity risks. Our Chief Executive Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Cybersecurity risk management is part of the Company's overall risk management. Our cybersecurity risk management is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third party service providers. Our primary third party service providers, utilize two (2) factor authorization as well as login and password protections with email verifications.

companyName: Oyocar Group Inc.

ticker: OYCG


text: Our Board has overall oversight responsibility for our risk management, including our cybersecurity risk management. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored. We have not experienced any cybersecurity incidents in fiscal year 2024.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.


text: The Company has implemented comprehensive procedures and infrastructure to protect our network from cybersecurity attacks. However, since such threats are ongoing and continue to evolve, we regularly consider the effectiveness of our cybersecurity framework. Our Director of IT, reporting to our Chief Financial Officer, has primary management responsibility over day-to-day oversight and evaluation of cybersecurity systems and processes, including monitoring for potential cyber threats. The Director of IT meets with the Chief Financial Officer and senior management, and when appropriate, the Board of Directors, to provide updates when there are changes to our risk management, systems, processes, or efforts. The Company conducts regular training for employees to mitigate cyber risks such as exposure to phishing and social engineering attacks. In the event of a network security incident, senior management and our Audit Committee are notified immediately. The Audit Committee takes the lead on behalf of the Board of Directors. The full Board of Directors is informed regularly of the status of any and all cyber incidents. We have a comprehensive incident response plan which is carried out by our IT department under the oversight of senior management and our Audit Committee and includes engagement of third party cybersecurity experts and our cyber insurance carrier and legal teams, as needed.

companyName: GEE Group Inc.

ticker: JOB


text: As of September 30, 2025, we have not identified any material weaknesses in our cybersecurity controls. Our ability to protect our business from cybersecurity risks is subject to uncertainty, and there can be no assurance that our cybersecurity measures will prevent all potential attacks.


text: Risk Management and Strategy In the ordinary course of business, the Company is subject to cybersecurity risks, which the Company manages as a component of its overall risk management strategy. The Company's management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. The Company has created a cybersecurity monitoring and reporting framework that it uses to respond to any potential cybersecurity risks. As part of this framework, the Company utilizes a third-party vendor to provide network security and assist with protection against cybersecurity risks through network assessments, monitoring, and related activities. The Company's management continues to assess material risks from cybersecurity threats, its compliance policies, and its reporting framework in order to limit the risk posed by cybersecurity incidents.

companyName: Kingfish Holding Corp


text: The Board of Directors conducts informed oversight of the Company's risk management process, including risks from cybersecurity threats. The Board of Directors is responsible for monitoring and assessing strategic risk exposure. The Company's management is responsible for identifying any potential cybersecurity risks to the Board of Directors and monitoring compliance practices at the operational level.


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not affect the Company's business in a material manner. At the effective date of this Annual Report, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Our Board actively oversees our enterprise risk management program. Our Board's role in risk oversight is consistent with our overall leadership structure: management is responsible for assessing and managing our short- and long-term risk exposures, and our Board and its committees provide effective oversight through independent monitoring of strategic risks and regularly scheduled meetings with management to discuss in-depth the strategic objectives of the Company and associated risks. In order to maintain effective Board oversight across the entire enterprise risk management program, the Board delegates to the individual committees certain elements of its oversight function. The Audit Committee of the Board has oversight of cybersecurity risk and receives regular updates on any developments from our Chief Information Security Officer ("CISO"), including biannual updates on strategies and action plans, with periodic reports provided to our full Board.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: We have an Enterprise Risk Council made up of leaders from our principal functional areas and business units that meets on a quarterly basis to update our enterprise risk framework used to identify and manage our key risks, including cybersecurity. Cybersecurity is a standing item on our Enterprise Risk Council agenda and our cybersecurity team regularly presents its work to the Enterprise Risk Council to enable evolving risks to be integrated into our management processes. All cybersecurity processes and frameworks are created by the Global Information Security team, led by our CISO. Our CISO has a Systems Engineer degree in Computer Science from St. Petersburg University of Information Technology and gained experience in the manufacturing, consultancy, and energy industries prior to joining the Company in 2012. Our CISO is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Information Technology Infrastructure Library (ITIL) v3 Expert, and Certified in Risk and Information Systems Control (CRISC).


text: Our Integrated Information Security Framework ("IISF") defines the policies and processes we have in place to safeguard proprietary and confidential information. Our IISF is based on relevant industry frameworks and laws, including, but not limited to National Institute of Standards and Technology ("NIST"), Good Practices Quality Guidelines (GxP), Health Information Trust Alliance (HITRUST), the ISMS Family of Standards (ISO 27000 family), Control Objectives for Information Technologies (COBIT), the EU General Data Protection Regulation (GDPR), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The framework consists of policies, standards, procedures, work instructions and documentation. Information is classified into four categories to help individuals apply the right level of controls and safeguards to information, applications and systems. In 2023, we conducted a mapping with the NIST to align our procedures with industry standards in an effort to create a first-in-class approach. Our global data centers and IT controls are included in an annual SOC2 Type II attestation program carried out by an independent audit firm who performs control testing and issue reports. Our set of SOC2 controls is aligned with ISO 27001 specification and therefore provides an equivalent level of assurance on a global level. Additionally, our cybersecurity controls are regularly assessed as part of our global Internal Audit plan, and the maturity of our Information Security program is also regularly assessed on at least an annual basis with the help of independent consultants.


text: Our internal Business Information Security Office ("BISO"), established in 2022, continues to streamline communications between our IT function and business units. The BISO connects several key functions, including Chief Information Officer Business Partnership, business continuity, governance, risk, and compliance.


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, data centers, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery / business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for threats and unauthorized access. We learn of security threats through automated detection solutions as well as reports from users and business partners. We draw on the knowledge and insight of external cybersecurity experts and vendors and employ an array of third party tools to secure IQVIA information infrastructure and protect systems and information from unauthorized access. We manage risk in our supply chain through engagement with suppliers and vendors, including vendor on-boarding risk assessments, ongoing oversight, and independent cyber-reputation score monitoring for key suppliers.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. To protect against such threats, we employ an array of data security technologies, processes and methods across our infrastructure to protect systems and sensitive information from unauthorized access. We maintain comprehensive identity and access management practices (e.g., roles and access privileges for each user; multi-factor authentication, privileged user accounts, single sign-on, user lifecycle management) and employ a variety of security information and event management tools. Non-technical safeguards also play an important role in our cybersecurity program. We provide various training programs and tools to employees so they can avoid risky practices and help us promptly identify potential or actual issues. We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow-up on matters already reported. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.


text: Our Board actively oversees our enterprise risk management program. Our Board's role in risk oversight is consistent with our overall leadership structure: management is responsible for assessing and managing our short- and long-term risk exposures, and our Board and its committees provide effective oversight through independent monitoring of strategic risks and regularly scheduled meetings with management to discuss in-depth the strategic objectives of the Company and associated risks. In connection with Board oversight across the entire enterprise risk management program, the Board delegates to the individual committees certain elements of its oversight function. The Audit Committee of the Board has oversight of cybersecurity risk and receives regular updates on any developments from our Chief Information Security Officer ("CISO"), including biannual updates on strategies and action plans, with periodic reports provided to our full Board.


text: We have an Enterprise Risk Council made up of leaders from our principal functional areas and business units that meets on a quarterly basis to update our enterprise risk framework used to identify and manage our key risks, including cybersecurity. Cybersecurity is a standing item on our Enterprise Risk Council agenda and our cybersecurity team regularly presents its work to the Enterprise Risk Council to enable evolving risks to be integrated into our management processes. The Global Information Security team, led by our CISO, create cybersecurity processes and frameworks for use throughout IQVIA. Our CISO is an experienced cybersecurity leader with over 25 years of experience in security, technology and risk management, and has previously served as a public company CISO for a global financial services firm, where he spent 18 years serving in roles of increasing responsibility, leading large cross functional security and technology teams.


text: The IQVIA cybersecurity program employs policies, procedures, guidelines, training, communications, tools, assessments and other methods and resources to identify and manage cybersecurity risks. Our Integrated Information Security Framework ("IISF") defines minimum controls and safeguards used to safeguard proprietary and confidential information. Our IISF is based on relevant industry frameworks and laws, including, but not limited to National Institute of Standards and Technology ("NIST"), Good Practices Quality Guidelines (GxP), Health Information Trust Alliance (HITRUST), the ISMS Family of Standards (ISO 27000 family), Control Objectives for Information Technologies (COBIT), the EU General Data Protection Regulation (GDPR), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The framework is integrated with IQVIA policies, standards, procedures, work instructions, documentation and development and oversight activities. Information is classified into four categories to help individuals apply the right level of controls and safeguards to information, applications and systems. In 2023, we conducted a mapping of the IISF with the NIST framework to make it easier for customers and other stakeholders to understand how IQVIA's cybersecurity program aligns with published frameworks. Our global data centers and IT controls are included in an annual SOC2 Type II attestation program carried out by an independent audit firm who performs control testing and issues reports. Our set of SOC2 controls is aligned with ISO 27001 specification and therefore provides an equivalent level of assurance on a global level. Additionally, our cybersecurity controls are regularly assessed as part of our global Internal Audit plan, and the maturity of our Information Security program is also regularly assessed on at least an annual basis with the help of independent consultants.


text: Our internal Business Information Security Office ("BISO"), established in 2022, continues to streamline communications between our IT function and business units. The BISO connects several key functions, including the Chief Information Officer Business Partnership, business continuity, governance, risk management, and compliance.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. To protect against such threats, we employ an array of data security technologies, processes and methods across our infrastructure to protect systems and sensitive information from unauthorized access. We maintain comprehensive identity and access management practices (e.g., roles and access privileges for each user; multi-factor authentication, privileged user accounts, single sign-on, user lifecycle management) and employ a variety of security information and event management tools. Non-technical safeguards also play an important role in our cybersecurity program. We provide standard operating procedures, work instructions, guidelines, communications, training programs, tools and other documentation and resources to help employees avoid risky practices, help us promptly identify potential or actual issues and employ cybersecurity requirements in their day-to-day work We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow-up on matters already reported. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.


text: We recognize the importance of maintaining the trust and confidence of our tenants, business partners and employees with respect to the integrity of our IT network and related systems. We seek to address cybersecurity risks and preserve the confidentiality, security and availability of the information collected and stored on our IT networks and related systems through a comprehensive approach focused on (i) identifying, evaluating and managing our cybersecurity risks, (ii) preventing or mitigating potential threats, and (iii) responding appropriately to security breaches, cyber-attacks, IT network failures and other incidents, if and when they occur. While risk management is primarily the responsibility of our senior management team, our board of directors plays a role in overseeing our cybersecurity risk management program. Our board of directors administers this oversight function directly and with support from its audit committee, which has been delegated the responsibility to evaluate our major financial risks, including our policies and practices to govern the process by which risk assessment and management is undertaken.

companyName: STAG Industrial, Inc.

ticker: STAG


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially and adversely affected the Company (including our business strategy, results of operations or financial condition), nor are such threats reasonably likely to materially and adversely affect the same.


text: For additional information regarding our cybersecurity risks, see "Item 1.A. Risk Factors—Other General Risks—We face risks associated with system failures through security breaches or cyber-attacks, as well as other significant disruptions of our information technology ("IT") networks and related systems" above.


text: Risk Management and Strategy Our cybersecurity risk management program is focused on the key areas below: • Governance. In fulfilling its oversight responsibility, our board of directors receives regular reports from our senior management team on our cybersecurity risks and exposures, infrastructure and countermeasures, and other monitoring, testing and recovery systems. • Collaborative Approach. We use a comprehensive, cross-departmental approach for identifying, evaluating, preventing and/or mitigating cybersecurity threats and incidents, and have implemented controls and procedures that provide for the prompt escalation of significant cybersecurity incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner. • Technical Safeguards. We deploy technical safeguards intended to protect our IT networks and related systems from cybersecurity threats, including firewalls, intrusion prevention, detection and isolation systems, anti-virus and malware functionality, backup functionality. and access controls. These technical safeguards are regularly evaluated and improved through vulnerability assessments, network penetration testing and threat intelligence, including by third-party consultants, who also continually monitor our information security. Any significant developments related to our technical safeguards, including the results of any vulnerability assessments or network penetration testing, are reported to our board of directors, and we adjust our cybersecurity risk management policies and practices as necessary. • Management of Third-Party Risks. We use a risk-based approach to evaluating cybersecurity risks presented by third parties, such as vendors, service providers, and external users of our IT networks and related systems, as well as risks related to our use of third-party systems that could adversely affect our business in the event of a cybersecurity incident centered on those systems. • Education and Awareness. We provide regular, mandatory cybersecurity training for our employees to help them identify and avoid potential cybersecurity threats and understand our policies and guidelines related to our IT network and related systems. As part of this training program, we regularly test our employees for information security awareness, including through random electronic communications designed to simulate how a threat actor might attempt to compromise our IT network and related systems. • Cybersecurity Insurance. We carry comprehensive cyber liability insurance coverage that covers us against claims related to certain first-party and third-party losses, including data restoration costs and crisis management expenses, subject to the policy's coverage conditions and limitations.


text: Our board of directors, together with the audit committee of our board of directors, oversees our cybersecurity risk management program. In addition, the audit committee is responsible for reviewing with management the effectiveness of our internal control structure and procedures for financial reporting systems, including, among other things, our internal controls designed to assess, identify, and manage material risks from cybersecurity threats.


text: On regular basis, our board of directors receives a presentation on cybersecurity risks from our senior management team, which may, depending on relevance at the time of the report, address topics such as prevailing cybersecurity threats, vulnerability assessments and/or network integrity testing, infrastructure and practice updates, and other considerations applicable to our IT network and related systems and other third-party systems.


text: Members of management work collaboratively to develop and implement policies, practices and procedures to protect our IT networks and related systems from cybersecurity threats and to respond appropriately and timely to any cybersecurity incidents. The members of management responsible for our cybersecurity risk management program include our Vice President–Information Technology, our Chief Financial Officer, our General Counsel, our Chief Accounting Officer, our Head of Data, Analytics and Technology, and our Vice President–Financial Reporting and Accounting. Through ongoing communications from employees in each of our Data, Analytics and Technology and Information Technology departments, such members of management monitor our assessment of material cybersecurity risks, our prevention and detection of cybersecurity threats, and, if a cybersecurity incident were to occur, our mitigation and remediation of such incident.


text: We believe the members of our management team involved in assessing and managing material cybersecurity risks have the experience needed to perform their duties, including through education, certification, work experience or a combination thereof. For example, our Vice President–Information Technology has approximately 25 years of IT experience in various roles, the majority of which has been at publicly-reporting real estate companies. In addition, the other members of our management team identified above have from 14 years to 29 years of work experience managing risks or control environments, including experience at the Company and other professional businesses, or, as third-party advisors, helping businesses manage risks or control environments.


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially and adversely affected the Company (including our business strategy, results of operations or financial condition), nor, in our view, are such threats currently reasonably likely to materially and adversely affect the same.


text: Risk Management and Strategy Our cybersecurity risk management program is focused on the key areas below: • Governance. In fulfilling its oversight responsibility, our board of directors receives regular reports from our senior management team on our cybersecurity risks and exposures, infrastructure and countermeasures, and other monitoring, testing and recovery systems. • Collaborative Approach. We use a comprehensive, cross-departmental approach for identifying, evaluating, preventing and/or mitigating cybersecurity threats and incidents, and have implemented controls and procedures that provide for the prompt escalation of significant cybersecurity incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner. • Technical Safeguards. We deploy technical safeguards intended to protect our IT networks and related systems from cybersecurity threats, including firewalls, intrusion prevention, detection and isolation systems, anti-virus and malware functionality, backup functionality, and access controls. These technical safeguards are regularly evaluated and improved through vulnerability assessments, network penetration testing and threat intelligence, including by third-party consultants, who also continually monitor our information security. Any significant developments related to our technical safeguards, including any material results of any vulnerability assessments or network penetration testing, are reported to our board of directors, and we adjust our cybersecurity risk management policies and practices as necessary. • Management of Third-Party Risk s. We use a risk-based approach to evaluating cybersecurity risks presented by third parties, such as vendors, service providers, and external users of our IT networks and related systems, as well as risks related to our use of third-party systems that could adversely affect our business in the event of a cybersecurity incident centered on those systems. • Education and Awareness. We provide regular, mandatory cybersecurity training for our employees to help them identify and avoid potential cybersecurity threats and understand our policies and guidelines related to our IT network and related systems. As part of this training program, we regularly test our employees for information security awareness, including through random electronic communications designed to simulate how a threat actor might attempt to compromise our IT network and related systems. • Cybersecurity Insurance. We carry comprehensive cyber liability insurance coverage that covers us against claims related to certain first-party and third-party losses, including data restoration costs and crisis management expenses, subject to the policy's coverage conditions and limitations.


text: Members of management work collaboratively to develop and implement policies, practices and procedures to protect our IT networks and related systems from cybersecurity threats and to respond appropriately and timely to any cybersecurity incidents. The members of management responsible for our cybersecurity risk management program include our Vice President–Information Technology, our General Counsel, our Chief Accounting Officer, our Senior Vice President–Data and Technology, and our Vice President–Financial Reporting and Accounting. Through ongoing communications from employees in each of our Data, Analytics and Technology and Information Technology departments, such members of management monitor our assessment of material cybersecurity risks, our prevention and detection of cybersecurity threats, and, if a cybersecurity incident were to occur, our mitigation and remediation of such incident.


text: We believe the members of our management team involved in assessing and managing material cybersecurity risks have the experience needed to perform their duties, including through education, certification, work experience or a combination thereof. For example, our Vice President–Information Technology has approximately 26 years of IT experience in various roles, the majority of which has been at publicly-reporting real estate companies. In addition, the other members of our management team identified above have from 15 years to 30 years of work experience managing risks or control environments, including experience at the Company and other professional businesses, or, as third-party advisors, helping businesses manage risks or control environments.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity standards and practices are guided by CIS's Critical Security Controls, which provides a framework for prioritizing best practices to improve the Company's cyber security measures.

companyName: Revance Therapeutics, Inc.


text: The Company, using CIS's guidance, approaches cybersecurity threats, through a cross-functional, multilayered approach, for purposes of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, consumers, patients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.


text: Vigilance: The Company's endpoints and networks are monitored 24/7 by its security operations center and the Company conducts periodic reviews and testing to prevent and mitigate cybersecurity threats and respond to cybersecurity incidents.


text: Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Collaboration: The Company collaborates with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.


text: Training: The Company provides periodic training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices.


text: Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are evaluated annually.


text: Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's IT, legal, enterprise risk and compliance, internal audit and other key business functions, as well as the members of the Board and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's Chief Financial Officer, the Company's VP of Information Technology, other members of management and the Company's external Chief Information Security Officer.


text: A key part of the Company's strategy, informed by CIS's guidance, for managing risks from cybersecurity threats is the regular evaluation, ongoing assessment and testing of the Company's processes and practices through assessments, tabletop exercises, threat modeling, penetration testing, employee training and testing (including on phishing scams), and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets preestablished factors, as well as ongoing updates regarding such incident until it has been resolved. Cybersecurity events that meet specified criteria are also escalated to the Disclosure Committee. At least once each year, the Audit Committee holds a meeting dedicated to cybersecurity matters, in addition to receiving quarterly updates on cybersecurity matters at regularly scheduled Audit Committee meetings. On an annual basis, Company management presents to the Board on the Company's approach to cybersecurity risk management.


text: The Company's VP of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with the Company's Chief Financial Officer and other business leaders across the Company, including in cybersecurity and legal and enterprise risk & commercial compliance. The VP of Information Technology has over twenty years of technology experience, during which his responsibilities have included technology operations, third-party assessments and risk management.


text: The Company has established a Core Incident Response Team, which is comprised of the VP of Information Technology and members of the cybersecurity, legal and enterprise risk & commercial compliance teams. The Core Incident Response Team works with other members of the Company's management and collaboratively across the Company to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Core Incident Response Team, along with the Chief Financial Officer, monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time. Cybersecurity events that meet specified criteria are escalated for further review by the Audit Committee and/or the Disclosure Committee.


text: The Disclosure Committee assesses and determines materiality based on the information provided by the Incident Response Team and makes recommendations to the Chief Financial Officer regarding disclosure.


text: In addition, the Company's VP of Information Technology works closely with an external Chief Information Security Officer to provide valuable perspectives and industry insights into evaluating cybersecurity threats. The Chief Information Security Officer has over twenty-five years of experience in cross-vertical security, software, and systems engineering.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: Nutex manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: Nutex Health Inc.

ticker: NUTX


text: Our cybersecurity program is managed by our Director of Information Technology and Chief Operating Officer. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the Director of Information Technology and Chief Operating Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Director of Information Technology and Chief Operating Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


text: We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We will perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Director of Information Technology and Chief Operating Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Director of Information Technology and Chief Operating Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Director of Information Technology has more than 25 years of information technology experience across the healthcare industry before joining Nutex Health. The Chief Operating Officer has more than 20 years of in-depth knowledge of our business operations that helps integrate the cybersecurity program into the overall business operations.


text: As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: Risk Management and Strategy We believe cybersecurity is critical to our mission to help every person live their healthiest life. Our customers, members, partners, and employees trust Accolade to maintain a secure environment for their health information. We process and maintain sensitive data on our customers and members in the form of PHI and PII and we maintain intellectual property of our solutions and PII of our employees. Because of the sensitivity of this data, we are subject to various cybersecurity threats that could adversely affect our business, customers, and members through impacts to the confidentiality, integrity, and availability of our systems.

companyName: Accolade, Inc.


text: As part of our enterprise risk management ("ERM") program, we maintain a cybersecurity program in an effort to reduce the risk of a breach of our systems or information. Our cybersecurity program includes policies and controls which are regularly reviewed through internal assessments. We have an active HITRUST certification for our expert medical opinion offering and Service Organization Control ("SOC") 2 Type II security compliance reports that are issued by third-party entities for our other offerings. We have controls in place intended to assess our cybersecurity readiness and prevent unauthorized access to our critical systems, including, for example, vulnerability scanning of our systems, detection and blocking of potentially malicious email, multifactor authentication, and security review of our vendors. We also actively engage with the law enforcement community, industry groups, and key vendors to maintain awareness of the evolving threat environment. We have a documented cybersecurity response plan for identification and assessment of cybersecurity incidents, including an escalation process for management to assess the materiality of an incident.


text: Despite our cybersecurity program, we cannot guarantee that we will not be subject to a material cybersecurity incident. For a description of the risks from cybersecurity threats that may materially affect the Company, and how they may do so, see Item 1A-"Risk Factors" included elsewhere in this Annual Report on Form 10-K. As of the date of this Annual Report, we have determined that there have been no cybersecurity incidents which materially impacted our business, financial condition, or results of operations.


text: Our board of directors maintains oversight of our risk management and the audit committee of our board of directors maintains primary responsibility related to overseeing our cybersecurity risk. One member of our audit committee has experience in cybersecurity and provides perspective regularly. We maintain a cybersecurity program to identify, assess, and manage our cybersecurity threats that is led by our Chief Information Security Officer ("CISO") and General Counsel / Chief Compliance Officer. These individuals regularly engage with the audit committee and other members of senior management to discuss cybersecurity risks.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, employees and communities. The Board is actively involved in oversight of the Company's operational and strategic risk management process. With regard to cybersecurity risk, the Board (through the Audit Committee) periodically reviews information on management's policies and processes related to cybersecurity and data-protection, including its assessment, identification and management of material risks, mitigation strategy, governance and incident reporting that are based on recognized frameworks established by the National Institute of Standards and Technology (NIST), the International Organization for Standardization and other applicable industry standards. The entire Board receives periodic updates on the Company's cybersecurity risk management progress through the Company's general enterprise risk management ("ERM") program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Overall


text: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives periodic updates from the Company's ERM function, the Company's Executive Director of Information Security & Compliance, other members of management and relevant management committees and councils.


text: Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.