text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.


text: We have implemented incident response and breach management processes. Notifications are made based on the level of threat of the incident. Incidents are evaluated to determine materiality as well as operational and business impact. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors.

companyName: OOMA INC

ticker: OOMA

secItem: Item 1C


text: Although the "Risk Factors" section includes further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date.


text: Although we continue to invest in cybersecurity and to enhance our internal controls and processes, we cannot guarantee these measures will be sufficient to protect us from a network security incident. For further information regarding the risks we face from cybersecurity threats refer to the "Risk Factors" within this Form 10-K.


text: Cybersecurity Risk Management and Strategy Our executive team and board of directors recognize that effective cybersecurity risk management is critical to the safety and security of our data, systems, and products and, ultimately, the long-term success of the Company. We have a comprehensive multi-layered cybersecurity risk assessment program, which covers the identification, analysis, evaluation, and management of cybersecurity risks. The program is cross-functional involving the participation and input of internal stakeholders, third-party consultants, and board oversight. The program is reviewed and updated on a semi-annual basis, or sooner if needed.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: We engage in frequent and comprehensive monitoring of our systems, including network, systems, and application security monitoring integrated into a Security Information and Event Monitoring (SIEM) system. In addition, should a cybersecurity incident occur, our response plan is based on the NIST Special Publication 800-61 Revision 2 Computer Security Incident Handling Guide, and requires the following steps:


text: Discovery. Occurs when a potential security incident is reported. Discovery can be initiated in several ways, including by customer support, employees, business partners, as a result of IT logging and monitoring, or in response to customer or vendor correspondence. Containment is the priority in the Discovery phase.


text: Investigation. Occurs when the Discovery phase establishes a likelihood that the event is an actionable security incident that warrants further research and analysis. In the Investigation phase, the priority is to swiftly complete an accurate, thorough investigation of the security incident.


text: Response. Occurs when a security incident is a confirmed data breach; when a security incident requires the Company to take further action to protect the organization and/or affected parties whose sensitive personal information is at risk or has been compromised; or when additional administrative, physical, or technical controls are needed after a security incident. In the Response phase, the priority is to swiftly complete required notification and other procedures according to applicable law.


text: Closure. Occurs when the Company's incident response steering committee can review the security incident and actions taken to evaluate whether proper investigation and documentation have occurred, and the matter requires no further notice or containment. Root causes and steps to prevent future incidents have been identified.


text: In the Closure phase, the priority is to confirm that all necessary containment, investigation, and response tasks have been completed.


text: Review. Occurs after the event has been resolved. The priority in this phase is to review the investigation/response process and update this Plan based on the lessons learned.


text: We also have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third party service providers. We classify third parties engaged by us based on risk and impact to our business. Classification is broken into tiers as follows:


text: Tier 1. Access to critical infrastructure, data, or services affecting critical infrastructure. Administrative or privileged access to production systems, including hosting or developing systems, applications, websites, software, or SaaS solutions. Tier 2. Non-privileged access to Company applications.


text: Tier 3. No direct system access but may be associated through a partnership or have links hosted embedded within Company marketing material or websites.


text: Third party risk scores are weighted based on the classification tier and monitored over the course of the year. A change in risk score may trigger an audit for the third party as well as a remediation plan to address any identified gaps, which our information security team oversees in conjunction with the relevant business owner for the third party relationship.


text: While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, account takeover, fraudulent order, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition, and we do not believe such risks are reasonably likely to have such an effect over the long term. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - Our reputation and business may be harmed if our or our vendors' computer network security or any of the databases containing customer, employee, or other personal information maintained by us or our third-party providers is compromised, which could materially adversely affect our results of operations."


text: Cybersecurity Governance Our board of directors has ultimate oversight of our risk management policies and strategies. Our executive team, which is responsible for our day-to-day overall risk management practices, present to the board of directors on the various material risks to our Company, including risks related to information technology and cybersecurity.


text: The audit committee has formal oversight responsibility for cybersecurity, as delegated by our board of directors, and is responsible for reviewing our policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, our Chief Administrative Officer, Chief Technology Officer ("CTO"), and/or Chief Information Security Officer ("CISO") provide semi-annual updates to the audit committee with respect to cybersecurity incidents, mitigation, threats, risks, and management, which are also communicated to the full board.


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience at the Company and elsewhere, is responsible for developing and overseeing matters related to cybersecurity and reports directly to our CTO, who is accountable for the overall information technology and security strategy of the Company. The CISO receives reports on cybersecurity threats from several experienced information security professionals responsible for various parts of the business on an ongoing basis and, in conjunction with our enterprise risk steering committee, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO works closely with our legal department to oversee compliance with legal, regulatory and contractual security requirements. Our enterprise risk steering committee is comprised of key stakeholders throughout the Company and works with management and our CISO to (i) identify and review certain cybersecurity risks that we face, including the probability and impact of such risks, and (ii) identify steps needed to eliminate or mitigate such risks. In addition, we have a well-defined cybersecurity incident response plan, as described above. Finally, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the audit committee and the board of directors.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a data security incident response policy and a security incident response plan, which were first developed in 2017 and are periodically reviewed and updated.

companyName: LANDS' END, INC.

ticker: LE


text: We have designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, rather only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to our legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • a data security incident response policy and a security incident response plan that include detailed procedures for responding to cybersecurity incidents, determining severity of cybersecurity incidents and notifying appropriate internal and external parties; • third-party and internal risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team consisting of members of our information technology department, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • periodic tabletop exercises involving the security team, the data security incident management team, and members of management, with special sessions expected to occur for the Board of Directors; • annual audit by a Payment Card Industry ("PCI") qualified security risk assessor to validate our PCI compliance; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • regular cybersecurity awareness training, including social engineering and phishing testing of our employees, incident response personnel, and senior management; • deployment of external tools designed to detect and protect against spam, malware and other cybersecurity threats and train personnel; and • third-party security event monitoring.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be adequate, fully complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – RISKS RELATED TO INFORMATION TECHNOLOGY, CYBERSECURITY AND DATA PRIVACY."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of data protection and cybersecurity risks as part of the Audit Committee's oversight of the Company's enterprise risk management framework. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity.


text: The Audit Committee receives regular reports from management on our cybersecurity risks, which include updates on trends and threats, the Company's backup and response systems, internal and external risk assessments, results of PCI and other security audits, and planned updates and upgrades. The Audit Committee also receives regular enterprise risk management updates, which include management of cybersecurity risks.


text: In accordance with our data security incident response plan, management is required to promptly update and discuss with the Audit Committee any material or potentially material cybersecurity incidents and provide an update to the Board upon determination. Management regularly updates the Audit Committee regarding incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, Chief Technology Officer and General Counsel (the cybersecurity disclosure committee), is responsible for assessing material risks from cybersecurity threats and our General Counsel oversees any required reporting obligations and notifications. Our Chief Technology Officer has primary responsibility for overseeing our security incident response plan, including identification and initial assessment of threat levels and escalations. Critical incidents are escalated to a cross functional data security incident management team for review, which then escalates potentially material incidents and threats to the cybersecurity disclosure committee for determinations of materiality and Audit Committee and Board communications. Our Chief Technology Officer has 20 years of experience with cybersecurity management response, and multiple direct reports who have 10 or more years of experience leading technology infrastructure and security incident response. Our General Counsel has over seven years of experience leading our incident response management team.


text: Our Chief Technology Officer is the primary point of responsibility for cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our customers and employees.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Our Information Security Department and Security Management functions, led by our Chief Information Officer ("CIO") and supported by our Director of Information Security and Compliance, (collectively, "Security Team"), help identify, assess and manage the Company's cybersecurity threats and risks. The Security Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools in certain environments and systems, internal and external audits of certain environments and systems, conducting scans of certain threat environments, evaluating our and our industry's risk profile, analyzing certain reports of threats and actors, conducting threat assessments for internal and external threats (including third party threat assessments) in certain environments, coordinating with law enforcement concerning select threats, subscribing to reports and services that identify cybersecurity threats, use of external intelligence feeds, conducting tabletop incident response exercises, evaluating certain threats reported to us, and conducting vulnerability assessments of certain environments and systems..


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident response policy, vulnerability management policy, risk assessments, encryption of certain data, network security controls and data segregation for certain environments and systems, access controls for certain environments and systems (such as identity controls and quarterly user access reviews), physical security, systems monitoring for certain systems, vendor risk management program, system configuration standards, employee security awareness training, asset management, managed detection and response tools, penetration testing, cybersecurity insurance and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Security Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, for example: professional service firms including legal counsel, threat intelligence service providers, cybersecurity consultants, 24/7 cybersecurity monitoring software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services and forensic investigators, managed detection and response providers, and external threat hunting partners.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and application providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment and security questionnaire for certain providers, review of security assessments for certain providers, and System and Organization Controls report reviews when determined necessary. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and our Director of Information Security and Compliance, who has over 20 years of experience in the information technology industry and is a Certified Information Systems Security Professional (CISSP).


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO, Director of Information Security and Compliance and the CFO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the CIO, the Chief Executive Officer and others. These individuals work with the Company's incident response team, pursuant to a documented incident response plan, to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports from the Security Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Maintaining the safety and security of our systems and data is essential to the success of our company. As with other industries, there are several cybersecurity threats we encounter. These include phishing, ransomware, and denial of service, among others. Our suppliers, vendors, and other partners face similar threats. A cybersecurity incident impacting us or any of these entities could materially affect our operations, performance, or financial results. See Item 1A, Risks Related to Information Security for additional details.

companyName: J.Jill, Inc.

ticker: JILL


text: The governance of our risk management program is a partnership between our cross functional management team and our Board of Directors. This program includes both a cyber team led by our Chief Information Officer ("CIO"), as well as an Enterprise Risk Management ("ERM") program led by our head of compliance. Our CIO has 30 years of information technology experience, including over 3 years of direct oversight of information security. Risk oversight for both our cyber and ERM programs is primarily the responsibility of the Audit Committee of the Board of Directors who receive quarterly updates, at a minimum, with additional updates shared to the full Board of Directors on a recurring basis.


text: Cyber Security Team Our cross functional cyber security team is responsible for the overall information security strategy, risk assessment, cyber threat detection and response, and execution of an ongoing cyber program. The goal of this team is to lower the impact and likelihood of persistent threats to the extent feasible, including safeguarding of key information and the integrity of key systems. We also partner with third-party vendors to enhance our program including monitoring, pen testing, and other assessments and programs. Additionally, the Company has implemented certain information security measures which include security reviews as well as internal training and testing programs.


text: Enterprise Risk Management (ERM) Program Our cyber risks are included in our ERM program. Our ERM program is led by our Senior Director of Compliance and Internal Audit and has oversight from our Audit Committee. This program includes a cross functional team including our senior leadership team and other key members of management. Risk reduction plans are developed and updates are regularly assessed by the team. Our Audit Committee provides oversight and is briefed quarterly, at a minimum. In the event a cyber incident should occur, there are additional steps taken to mitigate cybersecurity risks and incidents.


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.


text: Risk Management Approach and Strategy Our corporate information technology, accounting and financial reporting platforms, and related systems (our "Information Systems") are necessary for our business. We use these systems, among others, to manage key aspects of our business, including relationships with our tenants and vendors, accounting, acquisitions, internal and external communications and property and asset management. We also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data related to our business (our "Sensitive Data"). We engage a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our cybersecurity risk management is integrated into our overall enterprise risk management efforts and shares common methodologies, reporting channels and governance processes that apply across our overall enterprise risk management.

companyName: GENERATION INCOME PROPERTIES, INC.

ticker: GIPR


text: We and our MSP identify, assess and manage material cybersecurity threats and risks to our Information Systems and Sensitive Data through the following, among others: • a multidisciplinary team, including a dedicated technology committee (the "Technology Committee") comprising members from senior management, asset management and accounting and legal functions, in conjunction with our MSP and other third-party service vendors, to identify, assess and manage cybersecurity threats and risks; • various internal processes and procedures to monitor and evaluate threat environment and our risk profile using methods such as manual and automated tools, subscribing to reports and services that identify and analyze cybersecurity threats, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments; • various technical, physical and organizational processes and policies to manage and mitigate material cybersecurity risks, such as risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training and penetration testing; and • working with third-party vendors from time to time that assist us to identify, assess and manage cybersecurity risks, such as professional services firms and penetration testing firms.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools to allow security researchers to assist us in identifying vulnerabilities in our environment before they are exploited by malicious threat actors. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. Depending on the environment, we implement and maintain various processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information system and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training, and penetration testing.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: We work with third-party service providers from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to Item 1A "Risk Factors" in this Annual Report on Form 10-K for additional discussion about cybersecurity-related risks.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our audit committee is responsible for the oversight of risks from cybersecurity threats. Members of our audit committee receive updates on a quarterly basis from senior management, including leaders from our Information Technology team regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by our Information Technology team. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the audit committee on any appropriate items. The audit committee holds quarterly meetings and receives periodic reports from management, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them.


text: Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a real estate company with hundreds of properties located across the United States, we guard against a multitude of cybersecurity risks that range from threats common to most industries, such as ransomware and denial-of-service, to threats from more advanced, persistent, or organized actors, including those acting on behalf of nation-states that target critical infrastructure sectors. Tenants, lenders, suppliers, subcontractors, and equity partners throughout the industry face similar cybersecurity risks, and a cybersecurity incident impacting us or a related entity could materially adversely affect operations, performance, or operating results. These and related risks make it imperative that we vigilantly tend to the social, physical, and logical aspects of our cybersecurity.

companyName: ExchangeRight Income Fund


text: Identifying, assessing, and mitigating cybersecurity and related risks are disciplines we integrate into our overall enterprise risk management ("ERM") process. To the extent our ERM process identifies any relevant heightened cybersecurity related threat, we assign risk owners to develop mitigation plans, which we then track until full execution.


text: The Company is committed to the ongoing development and implementation of stringent processes to oversee and manage the risks associated with third-party service providers. Our policy is to conduct thorough security assessments of key third-party service providers prior to engagement, and to ensure compliance with our cybersecurity standards. Monitoring includes quarterly security assessments and annual evaluation of security controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Notwithstanding our commitment to high standards for cybersecurity, we may not always be successful in preventing a potential cybersecurity incident that could have a material adverse effect. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.


text: Oversight by Key Principals The Key Principals are the sole managers of ExchangeRight, which is the sole member and manager of our Trustee, and, accordingly, act as the directors of the Company. The Key Principals oversee management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The Key Principals are acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Key Principals are committed to effective governance in managing risks associated with cybersecurity in order to uphold operational integrity and stakeholder confidence.


text: Management's Role in Assessing and Managing Cybersecurity Risk The Chief Operating Officer of ExchangeRight (the "COO") oversees our information security team, which is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. The COO has information technology and program management experience, and has served many years overseeing our information security strategy. The information security team manages and continually enhances an enterprise security structure with the ongoing goal of mitigating cybersecurity risks to the extent feasible, while increasing our system resilience in an effort to minimize any potential business impact. Employees outside of our information security team also have a role in our cybersecurity defenses, and they are immersed in a corporate culture committed to security.


text: The COO notifies the Key Principals of our cybersecurity and information security posture as appropriate and the Key Principals are apprised of cybersecurity incidents deemed to have any relevant business impact. The Key Principals, COO, our Chief Financial Officer, and our Executive Managing Principal maintain an open dialogue regarding emerging or potential cybersecurity risks. The COO keeps them appraised of updates on any significant developments in the cybersecurity domain, ensuring the Key Principals' oversight is both proactive and responsive.


text: The COO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The COO oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the information security team is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Key Management Personnel As disclosed above, the primary responsibility for our overall information security strategy and directive resides with our COO, Louis Swingrover, with reliance on our information security team. With over 25 years of cumulative experience in the field, our information security team brings a wealth of expertise to our organization. The team includes individuals with backgrounds in Information Technology, Data Science, Enterprise Applications, and Business Development. Their in-depth knowledge and expertise are instrumental in developing and executing our cybersecurity strategies.


text: Risks from Cybersecurity Incidents To date, we have not encountered a cybersecurity incident that has materially impaired our operations or financial condition.


text: Cybersecurity Risk Management and Strategy We have made substantial investments in cybersecurity risk management, and it is an integral part of our overall enterprise risk management program. We have implemented a variety of tools and a process designed to identify, monitor, evaluate and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers. Our process consists of steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider; implementing cybersecurity countermeasures and mitigation strategies, and informing management and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape. We intend to continue to make substantial investments in cybersecurity risk management to improve our tools and processes because the cybersecurity threat continues to evolve. While we continue to invest in our infrastructure environment and monitoring capability, and in due diligence with respect to the third parties with whom we interact, there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by us or any third-party vendor or service providers that we use.

companyName: AstroNova, Inc.

ticker: ALOT


text: Our Information Technology team reports to senior management and is responsible for assessing and maintaining our cybersecurity risk management program. In addition, they collaborate with third-party security specialists as necessary, aiming for thorough risk assessments and system improvements. Together with our third-party security service providers, the Information Technology team oversees our processes for the prevention, detection, mitigation, and resolution of cybersecurity incidents. Throughout the year, we regularly train our employees on cybersecurity awareness and confidential information protection. We review or update our cybersecurity policies and the effectiveness of our programs to manage cybersecurity risk on a continuing basis, to account for changes in the evolving cybersecurity threat landscape, as well as for any related legal and regulatory developments that may occur.


text: Cybersecurity threats have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the evolving nature of these risks and remain vigilant in our efforts to mitigate potential impacts. Refer to "Item 1A. - Risk Factors" in this annual report on Form 10-K, including, "We could experience a significant disruption in or security breach of our information technology system which could harm our business and adversely affect our results of operations," for additional discussion on our cybersecurity related risks.


text: Cybersecurity Governance Our management, including our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), and Information Technology team are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to provide reasonable assurance that such potential cybersecurity risk exposures are monitored, instituting appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Additionally, since we do not have a full time Chief Information Security Officer, we obtain additional domain expertise from third party outside resources. Our cybersecurity programs are managed under the direction of our CFO, who receives reports from our Information Technology team and third-party resources to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks.


text: Our board of directors has oversight responsibility for our overall enterprise risk management and directly oversees our cybersecurity risk management. As part of its enterprise risk management efforts, our board of directors regularly receives reports from management on our cybersecurity programs with regard to any risks that may arise from specific cybersecurity threats and incidents. The board of directors oversees management's programs, policies and processes in place that identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which we are exposed.


text: The Company maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. We are subject to federal and state laws and regulations governing privacy, security, and breaches of patient information and the conduct of certain electronic health care transactions, including, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other health information privacy and security requirements. We rely on information technology networks and systems to process and store electronic information. We collect and store sensitive data, including personal identifiable information on our information technology networks. As we collect and manage large quantities of data, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our partners regard as significant. Increased global cybersecurity vulnerabilities, threats, computer viruses, ransomware and phishing attacks, and more sophisticated and targeted cyber-related attacks, as well as cybersecurity failures resulting from human error and technological errors, pose a risk to the security of the Company's systems and networks and the confidentiality, availability, and integrity of data on these products, systems, and networks. We have implemented security measures designed to prevent disruptions and shutdowns of our information technology networks due to attacks by hackers or breaches due to malfeasance by contractors, employees and others who have access to our networks and systems. We expect to continue to invest in long-term solutions to protect against cybersecurity risks and threats. Except as otherwise provided herein, this Item 1C reflects the Company's cybersecurity policies and procedures as of December 31, 2023.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report.


text: Risk Management and Strategy The Company employs an IT Security Team that is responsible for assessing and managing cybersecurity risks.


text: The Company has a designated IT Security Team to maintain its cybersecurity program and oversee third-party service providers that provide cybersecurity protection. The IT Security Team is tasked with the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and reports to our DevOPS/Security Manager. The team is comprised of personnel with a broad range of experience across the business and information technology industries, including our DevOPS/Security Manager, a DevOPS Security Administrator, and employees in senior legal and administrative roles. The IT Security Team relies on the advice of the Manager DevOPS/Security related to the security of our data and any mitigation steps necessary.


text: Our DevOPS/Security Manager leads our cybersecurity program and is tasked with supporting our security functions of identifying, preventing, detecting, responding to, and recovering from cybersecurity threats and incidents. The DevOPS/Security Manager has 27 years of experience in IT networking, administration, and security related roles, including nine years at the Company. Prior to joining the Company, our DevOPS/Security Manager served for 15 years in a senior leadership role in the IT department of a large, publicly traded Fortune 500 company. The DevOPS/Security Manager provides quarterly updates to the Cybersecurity Committee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies. Our DevOPS Security Administrator has experience developing and maintaining an IT security program for a Fortune 500 company, has a bachelor's degree in information technology, and maintains a Comptia Security+ certification. The Company has established processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: The Company utilizes a hybrid platform consisting of a local and cloud environment. Our local environment connects to the cloud environment via an encrypted virtual private network ("VPN") connection. Our Site-to-Site connection consists of a firewall in our local environment which responds to a connection from a firewall in our cloud. Our networks have segregated subnets, and only allow designated staff access to our cloud environment, which is only accessible from one of our local office segments. All firewalls are configured with intrusion detection systems and intrusion prevention systems, strict firewall rules, denial of service, spoof protection, advanced threat protection, and zero-day protection. Our firewalls are configured to receive definition updates as they are released, and firmware updates are automatically installed when available. We secure our local network by not utilizing any wireless access points connected to any of our networks or firewalls, enabling port security on switches, following a principle of least privilege policy, and implementing Security Information & Event Management ("SIEM") to capture all network traffic & security events from both networking equipment, endpoints, and servers. We enforce a strict password policy with multi-factor authentication.


text: All computers and servers utilized by the Company are protected by endpoint protection, which provides real-time protection of local and network files, internet activity, and utilizes ransomware protection, application protection, malicious behavior protection, anti-malware scan interface protection, file integrity monitoring, and data loss prevention. Our endpoint protection software updates immediately upon definition releases. This endpoint has live protection and performs a deep system scan daily. Our endpoint protection products are managed by our IT Security Team via a dashboard that provides our team with immediate alerts, device isolation, and investigation features, and also contracted the use of a Managed Detection and Response ("MDR") service. The MDR service monitors our protected endpoints, servers, and network equipment at all times. This service also investigates, eliminates, and mitigates any critical alerts, while notifying our IT Security Team issues identified. All endpoints and servers are updated with security patches and application updates to our systems from a Patch Management system.


text: Our IT Security Team reviews security logs daily, and performs quarterly audits of device access, building access, outages, application access, and IT & Development tickets. We employ data loss prevention policies to enforce HIPAA rules and also use stringent encryption controls. In addition, a Vulnerability Scanning system performs vulnerability detection on a quarterly basis. An independent third-party company conducts annual penetration and vulnerability detection as well.


text: Our offices are physically secured with key card access controls for parking, first floor access, and elevator access. In addition, security guards monitor building reception areas and parking garages, and receptionists are located in our lobbies to greet visitors. The Company engages assessors, consultants, auditors, or other third parties in connection with its cybersecurity processes.


text: The Company engages third party vendors in connection with our cybersecurity processes, including penetration and vulnerability scanning, auditing of our information security management program (ISMP); and a provider of products and services to secure users, networks, and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyber attacks. In addition, the Company engaged national accounting and advisory services firms to audit the operating effectiveness of our security program, which incorporates cybersecurity in our processes. On an annual basis, the Company conducts a SOC 2 Type II audit and a HITRUST assessment.


text: SOC 2 Type II audits assess risks from interactions with the Company's systems, particularly information about system controls that the Company has designed, implemented, and operated to provide reasonable assurance that its service commitments and system requirements were achieved based on the SOC 2 trust services criteria.


text: A HITRUST assessment address the need for a continuously relevant cybersecurity assessment that incorporates best practices and leverages the latest threat intelligence to maintain applicability with information security risks and emerging cyber threats, such as ransomware and phishing. HITRUST assessments also provide a level of assurance that delivers full transparency, accuracy, consistency, and integrity.


text: In April 2022, an AICPA member firm and HITRUST authorized External Assessor Organization (the "Assessor") completed an independent assessment of the Company's systems. These independent assessments verified that we met the healthcare industry's highest standards in protecting healthcare information and mitigating this risk, including compliance with HIPAA rules and regulations. On March 2, 2023, the Assessor reported that the Company's data recovery system's commitments and system requirements meet or exceed the stringent SOC 2 Type II applicable trust services criteria. On October 13, 2023, HITRUST certified that the platforms, facilities, and supporting infrastructure of our organization meet the HITRUST CSF v11.1.0 Implemented, 1-year (i1) certification criteria. For our cloud computing services, we currently use a cloud service provider who is also HITRUST certified for the contracted services.


text: The Company has processes to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.


text: The Company maintains specific policies and practices governing our third-party security risks, including our third-party assessment ("TPA") process. Under our TPA process, we gather information from certain third parties who contract with the Company and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, utilize encrypted secure file transfer protocols to exchange data. We require counterparties to enter into Business Associate Agreements and Non-Disclosure Agreements that, among other things, require them to maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.


text: The Board has established a Cybersecurity Subcommittee of the Audit Committee responsible for the oversight of risks from cybersecurity threats.


text: On February 7, 2024, the Board established the Cybersecurity Subcommittee of the Audit Committee (the "Cybersecurity Committee") to assist the Board in fulfilling its oversight responsibilities with respect to assessing and mitigating the Company's cybersecurity risks. The Company's management, under the guidance of the IT Security Team, is responsible for the preparation, presentation, and self-assessment of the Company's cybersecurity policies and practices. The Cybersecurity Subcommittee shall be comprised of at least one independent director, and is tasked with reviewing and providing high level guidance on cybersecurity-related issues of importance to the Company.


text: The IT Security Team reports to the Cybersecurity Subcommittee on a quarterly basis to inform the committee about and monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents, and is tasked with notifying the Cybersecurity Subcommittee of a cybersecurity incident upon discovery.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Unity Biotechnology, Inc.


text: We design and assess our cybersecurity program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Head of Information Technology and Chief Legal Officer and Head of Operations, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 30 years of leading and managing IT infrastructure and security operations teams for various sized global companies across several different industries.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy Identifying, assessing, and managing material risks associated with "cybersecurity threats," as such term is defined in Item 106(a) of Regulation S-K, is important to Bitcoin Depot. Among the risks we strive to address and mitigate are the disruption of our business operations and the loss of personal and confidential data due to cybersecurity incidents, fraud, or extortion.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: We integrate the identification, assessment, and management of cybersecurity risks into our overall risk management systems and processes. We detect and address such risks from cybersecurity threats in several ways, including through third-party assessments, internal governance, risk and compliance, participation in industry groups to obtain intel, IT audits, and IT security reviews. To protect against, detect, and respond to cybersecurity incidents, we, among other things, leverage intrusion prevention and detection systems, perform penetration testing, conduct employee training, monitor emerging laws and regulations related to data protection and information security, and implement appropriate changes to comply with the identified emerging laws and regulations. To effectuate these processes, we regularly engage third-party auditors and advisors to assess our cybersecurity programs and ensure compliance with applicable guidelines, standards, and industry best practices.


text: Senior management, including our Bitcoin Depot's Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel are responsible for implementing these security measures, as well as being involved in all aspects of cybersecurity incident response and data breach management processes. Bitcoin Depot's incident management plan provides a roadmap for responding to and categorizing incidents. Bitcoin Depot's IT and cybersecurity teams collaborate with other company stakeholders to develop strategies for mitigating and responding to identified cybersecurity events.


text: Our cybersecurity threat and risk management processes also involve assessing third-party risks. We maintain a Vendor Management Policy pursuant to which we assign a risk rating and assess third-party risks by conducting cybersecurity due diligence on our vendors, suppliers, and other entities with whom we do business. Due diligence includes, as appropriate, either requiring proof of security standard compliance or satisfactory responses to our Vendor Assessment Security Questionnaire. We also evaluate the cyber practices of, and cybersecurity risks associated with, the engagement of third-party service providers, including when we negotiate cybersecurity and data privacy contract terms, such as those relating to information security and audit rights.


text: Although we constantly evaluate cyber risks, we are unaware of any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial conditions.


text: Cybersecurity Governance Our Board of Directors and management prioritize cybersecurity. Although our full Board of Directors is generally responsible for cybersecurity risk management, it has assigned principal oversight responsibility of risks from cybersecurity threats to our Audit Committee. As described above, management is also responsible for assessing and managing risks from cybersecurity threats, and designated management personnel, including our Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel and Corporate Secretary meet quarterly as a Risk Committee to determine cybersecurity matters to be shared with the Audit Committee. The Risk Committee provides the Audit Committee updates on such matters on at least a quarterly basis. The Audit Committee reports cybersecurity risks to the full Board during quarterly meetings.


text: The members of senior management involved in managing our material risks from cybersecurity threats, including our Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel and Corporate Secretary are experienced in data security matters and financial reporting matters. Our Chief Information Security Officer has more than 20 years of experience in information technology and has served in multiple technology executive roles, including security-compliance-related roles and holds a degree in Computer Information Systems from Harding University. Our Chief Technology Officer holds a computer science degree and Master of Engineering in Computer Science from Massachusetts Institute of Technology and has held engineering roles in multiple financial technology companies. Our Cybersecurity Operations Director holds a Master of Science degree in computer engineering as well as a Master of Science degree in information assurance, both from Iowa State University. He has led the security operations centers for large, global data management software company, as well as a large payment processing company. Additionally, he has led audits and penetration tests as the senior manager of a consulting company. Prior to entering into the private sector, he served as a police officer where he was a detective, specializing in computer crimes and forensics. Our Chief Financial Officer has over 30 years of experience in financial statement reporting and auditing. Our General Counsel has significant experience advising on cybersecurity matters and data protection matters and building out cybersecurity and data privacy compliance program across business lines in the financial services industry.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our management actively oversees our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. We have established and maintain a Cybersecurity Maturity Model Certification ("CMMC") compliance program and are working to meet all applicable deadlines. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's investment in people and technologies have contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: GRESHAM WORLDWIDE, INC.


text: Risk Management and Strategy At a high level, the key objectives for the Company's cybersecurity program are to implement and sustain effective security controls to stop intrusion attempts and to maintain and continuously improve its ability to respond to attacks and incidents. Success in achieving these objectives relies upon using quality technology solutions, cultivating and maintaining a team of skilled professionals, and improving processes continuously. Our cybersecurity program in particular focuses on the following key areas:


text: Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment are used to develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment that are then reported to our members of management.


text: Technical Safeguards: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning: We have established comprehensive incident response and recovery plans that guide our response in the event of a cybersecurity incident. We continuously test and evaluate the effectiveness of those plans.


text: Vendor Risk Management: We have implemented a vendor risk management program, which is designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of on-boarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers in response to detailed questionnaires and meetings as well as information from third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate. Contract language, purchasing decisions, and/or technology implementation strategies are frequently adjusted as a result of this process.


text: Education and Awareness: Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. As part of that educational process, we periodically simulate cybersecurity threats to the Company and review/assess employee responses. In this regard, the Company has implemented policies and procedures for all employees including: (i) information security/cybersecurity policies, which are internally available for all employees, (ii) information security/cybersecurity awareness training; (iii) a clear escalation process which employees can follow in the event an employee notices something suspicious; and (iv) ensuring that information security/cybersecurity is part of the employee performance evaluation and/or disciplinary process.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels, and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Nuburu, Inc.

ticker: BURU


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents. We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations, and cash flows, under the heading "Cyber-attacks and other disruptions, security breaches, and incidents could have an adverse effect on our business, harm our reputation, and expose us to liability" included as part of our Item 1A. "Risk Factors" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: The Company outsources around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures, and cybersecurity risks. Periodically each year, the Audit Committee receives an overview from our Chief Executive Officer of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified, and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Risk Management and Strategy We are a clinical stage biopharmaceutical company, with no commercial operations or revenue streams and our sole business activity has been ongoing research into our drug therapies. We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our company grows, we plan to expand our strategy for cybersecurity in alignment with nationally accepted standards. We have not encountered cybersecurity risks that have materially affected or are reasonably likely to materially affect us or our business strategy. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. Our Audit Committee, comprised of members with substantial experience in information technology governance and risk management, oversees our cybersecurity strategy. They are advised by a virtual CISO consultant with Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP certifications, as well as extensive background in IT infrastructure, risk mitigation, and incident response planning. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: The Company has adopted processes designed to assess, identify, and manage material risks from cybersecurity threats that are integrated into the Company's overall risk management system. The Company's cybersecurity risk management processes are managed by Tuearis Cyber ("Tuearis") an outside contractor with significant experience and expertise in designing and implementing cybersecurity programs for corporate entities such as the Company.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: During the year ended December 31, 2023, the Company did not experience any risks from cybersecurity threats that materially affected or were reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: The Company's Board of Directors, through its Audit Committee (the "Committee"), working closely with the Company's corporate governance consultant, provides oversight of risks from cybersecurity threats by monitoring incident-based reports from Tuearis as to the existence and severity of such risks. When risks are identified, the Committee works with the Company's corporate governance consultant to develop appropriate responses, based on the recommendations of Tuearis. The Company does not have an employee with specific expertise in cybersecurity risk management but relies on Tuearis to provide that expertise. All material cybersecurity risks, incidents, and responses are reported to the Committee as a routine matter.


text: As a vertically integrated self-hosted and self-mining Bitcoin miner, the stability and security of GRIID's operating environment, the protection of our intellectual property, and the integrity and cybersecurity practices of strategic third parties are critical. GRIID's information security program is designed to detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our systems from cybersecurity threats, we use various security tools that help prevent, escalate, investigate, and recover from identified vulnerabilities and security incidents in a timely manner. We also maintain a third-party risk management program to identify, prioritize, assess, mitigate, and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk and cannot guarantee their efforts will be successful in all circumstances.

companyName: GRIID Infrastructure Inc.


text: We regularly assess risks from cybersecurity and technology threats and monitor our systems for potential vulnerabilities and exploit attempts. We use a widely adopted risk quantification model to identify, measure, and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We take a risk-based approach to regular reviews and tests of our information security program and also leverage tabletop and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties and employees) and other data, confidential information, or intellectual property. To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report.


text: The Vice President of Information Security leads our information security program. Our VP of Information Security has over 20 years of industry experience, including serving in similar roles leading and evolving cybersecurity programs at other public companies. Regular reports are provided to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: As a newly public company, GRIID's Board of Directors will oversee our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. This oversight will include regular discussions on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: We deploy several processes for assessing, identifying and managing material risks from cybersecurity threats. These processes include, but are not limited to, security assessments, physical access restrictions, internal and external penetration testing, endpoint detection and response, and employee security awareness programs and training.

companyName: Fathom Digital Manufacturing Corp


text: Our cybersecurity processes have been integrated into our overall risk management processes, and we engage assistance from third parties as we deem necessary or appropriate. We believe that we have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third-party services providers to our business.


text: Our Information Technology team, under the direction of the Chief Executive Officer, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. They have many years of experience in various technology-related functions including security, auditing, compliance and systems. Our executive officers are briefed regularly on information security, including discussion of processes such as those listed above to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Our Board is charged with providing oversight of our risk management process, including risks from cybersecurity threats. Periodically, the Board reviews risk assessments, including cybersecurity risks, prepared by management and/or third-party providers.


text: There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including, but not limited to, exploitation of vulnerabilities, ransomware, denial of service, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.


text: We have an information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards.

companyName: SeaStar Medical Holding Corp

ticker: ICU


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.


text: We are committed to safeguarding our information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction. We aim to incorporate industry best practices throughout our cybersecurity program. This program is supported by both management and our Board of Directors, including our Audit Committee.

companyName: Astra Space, Inc.


text: The Compliance Committee is responsible for identifying, monitoring and mitigating compliance risks, including cybersecurity, and is comprised of the Chief Compliance Officer & General Counsel, CEO, CFO, Chief Technology Officer, Chief Business Officer, Chief People Officer, Vice President of Information Technology ("VP IT"), Corporate Controller and Senior Director, Internal Audit. The Compliance Committee meets regularly during the year and receives periodic updates on cybersecurity risks from the VP IT. The Compliance Committee is responsible for assessing the materiality of cybersecurity incidents based on quantitative and qualitative materiality factors, and for providing recommendations on public disclosures of cybersecurity incidents to the Audit Committee if an incident is identified to be possibly material. The Compliance Committee also provides input and consideration into internal controls surrounding cybersecurity along with reviewing cybersecurity risks, mitigation strategies, ensuring the cybersecurity strategy is in alignment with business objectives and is incorporated into the overall risk management processes.


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The Department of Defense's Cybersecurity Maturity Model Certification ("CMMC") initiative safeguards sensitive information within the Defense Industrial Base by ensuring members meet cybersecurity requirements for handling controlled unclassified information and federal contract information. The CMMC initiative helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe.


text: In addition, we have technology and information security processes, security and threat assessment plans and safeguards and periodic external service and service provider reviews in place led by our VP IT, governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the Board of Directors (including the Audit Committee chair).


text: Our Board of Directors has overall responsibility for risk oversight and is currently overseeing Astra's business continuity risks, including cybersecurity risks, which occurs at both the full Board level and at the Board committee level through the Audit Committee. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity from the VP IT, at least four times a year including, but not limited to, analysis of events that have impacted our peers, updates on program maturity, regulatory compliance status and cybersecurity program status and updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents impacting the Company, as well as any incidents with lesser impact potential. The Audit Committee regularly briefs our Board of Directors on the matters communicated to the Audit Committee.


text: Management's Role Our VP IT leads our information technology and cybersecurity function, including the role of Chief Information Security Officer ("CISO"), since early 2022. Our VP IT holds a Bachelor of Science in Cybersecurity and Information Assurance and is a systems security certified practitioner ("SSCP"). Our VP IT has served in various roles in information technology for over 25 years, including as vice president of a major cybersecurity company, where he directly oversaw the technical operations and cybersecurity. The VP IT oversees information security resources designed to assess and manage cybersecurity threats on a day-to-day basis.


text: Notwithstanding the foregoing efforts, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. No security program can entirely eliminate the risk of human error or malicious acts that are outside our reasonable control. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See Item 1A. Risk Factors for additional details regarding cybersecurity risks.


text: We believe we have appropriate processes for assessing, identifying and managing material risks from cybersecurity threats. Those processes are embodied in our enterprise-wide cybersecurity risk management program (Cyber Risk Program), which includes our cybersecurity governance structure and our cybersecurity strategy and processes.

companyName: E2open Parent Holdings, Inc.


text: Board of Directors Oversight Our board of directors has delegated oversight of our Cyber Risk Program to the Risk Committee of the board of directors. The presentations to the Risk Committee cover, among other things, our cyber incident experience, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages and our employee-training programs.


text: Management's Assessment and Management of Cybersecurity Threats Members of the executive management team, along with others from senior management and others with varying areas of expertise, are engaged as part of our Cyber Risk Program: • Executive Vice President, Product Development & Infrastructure R&D: Direct management of our Cyber Risk Program falls within our Product Development and Infrastructure Research and Development team. The Executive Vice President (EVP) in charge of this team has extensive experience regarding cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as E2open. The EVP is a member of our Cybersecurity Subcommittee of our Disclosure Committee, which is responsible for helping to determine whether a Cybersecurity Incident is "material" for purposes of publicly reporting cybersecurity incidents. Our EVP chairs our management Cybersecurity Subcommittee. • General Counsel: Our General Counsel has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims and loss mitigation. Our General Counsel is a member of our Cybersecurity Subcommittee of our Disclosure Committee. • Senior Vice President, Information Security and Compliance: Our Senior Vice President (SVP) has direct management of our Cyber Risk Program. He manages the day-to-day operations, oversees our security analysts and engineers and participates in our Cybersecurity Subcommittee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Subcommittee: We have created a Cybersecurity Subcommittee of our management Disclosure Committee which includes, in addition to the EVP and General Counsel, the Chief Accounting Officer. The Cybersecurity Subcommittee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts and make recommendations to leadership. Additionally, the Chair of the Subcommittee shall convene a meeting when either: (a) he believes a reported incident or the occurrence of a series of related incidents, requires the analysis and discussion of the Subcommittee; or (b) when any member of the Subcommittee believes that such a discussion would be appropriate. Such meeting shall be convened within 48 hours of the incident, or sooner if reasonably practicable, to expedite a materiality determination for public company reporting purposes.


text: • Response Team: Pursuant to our Crisis Response Program, our Response Team, which comprises the General Counsel, Chief Financial Officer and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the General Counsel or Chief Financial Officer, on behalf of the Response Team, will report to or engage the Chief Executive Officer and the Chairman of the board of directors if and when an incident becomes a crisis or potential crisis. • Other Roles: The Cyber Risk Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines and independent auditors to certify compliance with our internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework. We also conduct reviews for compliance with data protection regulation such as Europe's General Data Protection Regulation (GDPR) and regulation of various U.S. states such as the California Consumer Privacy Act (CCPA).


text: Risk Management and Strategy Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks The principal objectives of our Cyber Risk Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property and other assets of E2open, and those of our customers, vendors, partners, employees and consumers that can be at risk due to cybersecurity threats to E2open.


text: We have incorporated industry recognized cybersecurity frameworks and standards into our Cyber Risk Program, including frameworks from the National Institute of Standards and Technology (NIST) and security control auditing protocols from the Center for Internet Security (CIS) and the International Organizations for Standardization (ISO). Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, we continue to invest in updating and enhancing our Cyber Risk Program.


text: Under our Cyber Risk Program, our SVP, and the cybersecurity staff, along with our management-led Cybersecurity Subcommittee, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in our various policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Risk Committee and board or directors, informed. Pertinent policy and practice documents include, among others, E2open's Guidelines for Cybersecurity Determination for Item 1.05 of Form 8-K (governing the Company's materiality determination for reporting purposes) and our Crisis Response Plan.


text: As an important cybersecurity risk mitigant, E2open provides mandatory training to its new hires and quarterly training of its employees, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.


text: Integration into Overall Risk Management System or Processes Our risk management systems and processes comprise numerous components, including published policies and procedures, risk detection systems, tools, and protocols (automated and human), internal and external independent auditing, management committee review, defined lines of communications, employee training, engagement of outside advisors and experts, assessment and utilization of both commercial and self-insurance opportunities, customer contract standardization where possible, legal review of vendor engagements and new products for regulatory compliance, regular operations reviews with the Chief Executive Officer and Risk Committee. E2open utilizes the foregoing systems and processes to best ensure effective management of our risks and associated cybersecurity threats. The EVP reports to the Risk Committee at least quarterly on the status of our Cyber Risk Program.


text: Engagement of Third Parties As part of our Cyber Risk Program, we engage outside independent auditors, consultants, and professional advisors. We also engage industry-leading cybersecurity service and systems providers to assist with protection from and detection of cybersecurity threats and incidents and our responses to them.