text: In addition, we endeavor to apprise employees of emerging risks and require them to undergo bi-annual security awareness trainings and supplemental trainings as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: FGI Industries Ltd.

ticker: FGI

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards. We engage certain third parties to enhance and assist with our cybersecurity oversight, including a 24/7 Security Operation Center, or SOC, that monitors network devices and computer systems in real time. We include confidentiality and data protection provisions in certain contracts with third-party service providers to help protect us and our patients from any related vulnerabilities.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: We do not believe that there are currently any known risks from cybersecurity threats that have or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information on the most pertinent risks we may experience from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" – "Our internal computer systems, or those of our collaborators, vendors, suppliers, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs."


text: Cybersecurity Governance and Oversight The audit committee of our board of directors provides oversight over cybersecurity risk and updates the full board of directors periodically regarding such oversight. The audit committee reviews and discusses with management the Company's major risk exposures, including cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents, if any.


text: Our Chief Executive Officer, or CEO, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The consultant that operates our SOC updates the CEO regarding the detection of cybersecurity risk exposure and provides advice on the prevention, mitigation and remediation of such risks. The CEO keeps the senior executive leadership team apprised, including our Vice President of Finance, on assessments of risk exposure to ensure that the highest levels of management are kept abreast of potential risks we are facing. The CEO has significant prior business experience in compliance and risk management and coordinates directly with the third party who operates our SOC on issues involving particular cybersecurity expertise.


text: In an effort to help deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection cybersecurity and incident prevention training throughout the year, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Cybersecurity Strategy, Policy and Procedures We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined within Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We utilize information technology ("IT") that enables our teams to access both operational and financial performance data in real time, while at the same time, helping to identify and prevent cybersecurity threats and risks.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") framework, and shares common methodologies, reporting channels, and governance processes that apply across the ERM framework to other areas, including legal, compliance, strategic, operational, and financial risk. We assess and identify cybersecurity risk to the organization by: • Employing a cybersecurity policy that sets forth a protocol for assessing, testing, identifying and preventing security risks; • Conducting assessments of risk likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of IT systems and the related information processes, storage, or transmission; • Training personnel on security risks and how to identify and prevent such risks; • Performing risk analysis and security assessments that document the results of the assessment for use and review; • Overseeing and identifying any risk from cyber threats associated with any third-party service provider; • Ensuring security controls are assessed for effectiveness, implemented correctly and operating as intended; and • Continuously scanning for vulnerabilities and remedying vulnerabilities in accordance with the associated risk.


text: Cybersecurity is among the risks identified for Board-level oversight, with the Audit Committee of our Board of Directors responsible for overseeing our policies, practices, and assessments with respect to cybersecurity. Our Audit Committee and Board of Directors receive regular updates throughout the year on cybersecurity from our Finance, Risk and Sustainability (the "FRS") Committee, which is tasked with risk management, data protection, and monitoring compliance with our cybersecurity policy and also responsible for assessing and managing material risks from cybersecurity threats. The FRS Committee is comprised of our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Senior Vice President of IT, and VP of Corporate Development. Our cybersecurity risk management and strategy processes are led by our Senior Vice President of IT and our Chief Legal Officer, who collectively have extensive prior work experience and expertise over multiple decades developing and managing information security and cybersecurity strategy and programs and managing operational risk and incident response strategies.


text: Each member of our Board of Directors and Audit Committee also receives a quarterly report on cybersecurity matters and related risk exposures, and when the report is discussed during an Audit Committee meeting, the chair of the Audit Committee reports on related matters to our Board of Directors. Our Audit Committee also receives regular updates on our cybersecurity posture throughout the year, as appropriate.


text: In accordance with our cybersecurity policy, we have established a monitoring strategy and program which includes: • Defined security metrics to be monitored; • Performance of security control assessments on an ongoing basis; • Engaging third party security consultants to, among other things, conduct periodic reviews of our cybersecurity program, which is overseen by the FRS Committee, for identifying any cybersecurity threats; • Addressing results of both internal and third-party cybersecurity analyses and reporting security status to the executive team; • Monitoring information systems to detect attacks and indicators of potential attacks; and • Identification of unauthorized use of information system resources.


text: We have also implemented procedures set forth in our cybersecurity policy that secure sensitive data in our possession, which include: • Establishing policies governing data security; • Monitoring data access throughout the organization; • Providing annual security training and awareness; • Protecting sensitive data through encryption techniques; and • Designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster.


text: Incident Management Plan Our cybersecurity policy includes an incident management plan ("IMP"), which consists of the following processes: • The development, documentation, review and testing of security procedures and incident management procedures, which are regularly re-assessed, updated and tested; • The FRS Committee reviews any identified matters by assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The FRS Committee notifies the Board of Directors and the Audit Committee; • The FRS Committee consults with outside experts, if determined that the incident rises to a significant level; • The FRS Committee initiates containment by making tactical changes to the computing environment to mitigate active threats based on currently known information; • The FRS Committee establishes the root cause of incidents, identification and evidence collection from all affected machines and logs sources, threat intelligence and other information sources; • IT personnel recovers and restores normal business functionality, which includes the reversal of any damage caused by the incident and responding as needed; and • The FRS Committee reviews the closure of each incident and conducts a "lessons learned" analysis to improve prevention and ensure the IMP and cybersecurity plans are more efficient and effective.


text: We have faced and continue to face cybersecurity risks in connection with the conduct of our business. Although we do not believe such risks have materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information about the cybersecurity risks we face, see the risk factor entitled "Any security breach, unauthorized access or disclosure, or theft of data, including personal information, we, our third party service providers, or our suppliers gather, store, transmit or use, could harm our reputation, subject us to claims, litigation, and financial harm and have an adverse impact on our business" within Item 1A. Risk Factors.


text: Members of senior leadership, including the Volato Group Board ("Board"), assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The senior leadership team includes senior leaders in areas of importance to Company priorities. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors. Members of senior leadership discusses enterprise risks and compliance programs with the Audit Committee of the Board. The Audit Committee makes reports to the Board, who also receive updates from members of senior management on material risks to the Company.

companyName: Volato Group, Inc.

ticker: SOAR


text: Risk Management and Strategy There are no management positions directly responsible for overseeing our cybersecurity risk. The Chief Operating Officer ("COO") who functions as our head of IT and certain members of management assist with our cybersecurity efforts and risk assessments. The COO has over 10 years of prior experience in information technology and security.


text: We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including Microsoft Azure CSPM and SOC 2. We use this framework, together with information collected from periodic manual assessments and automated testing, to tailor aspects of our cybersecurity practices given the nature of our assets, operations and business. The Company's processes to assess, identify and manage material risks from cybersecurity threats include, but are not limited to, the following: • The members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures and provide for continuity of operations. • The Company uses various systems to manage threats, for example, firewall protections, anti-virus protections, vulnerability scans, among others. Such systems are regularly reviewed for adequacy and potential enhancements. • The Company employs an information security and training program for our employees, including regular internal communications and ongoing end-user testing to measure the effectiveness of our information security program. • The Company utilizes a third-party service that provides real-time threat intelligence feeds and global threat data to enhance threat detection capabilities and proactively defend against emerging cyber threats. • We monitor the location of our geographic location of data sent to third party systems.


text: In 2023, we conducted an enterprise risk assessment that included an assessment of cybersecurity risk in context with other enterprise-level risks. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors", of this Annual Report on Form 10-K.


text: In the last three years, we have not experienced a material information security breach incident, or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.


text: Risk Management and Strategy Overview Protecting the information systems, assets, data, and communication infrastructure is critical to the Company's operations. Consequently, cybersecurity is prioritized through the implementation of a comprehensive cybersecurity risk management program that is managed by the executive team leadership in conjunction with the IT Department and falls within the boundaries of the overall organization risk management program.

companyName: i-80 Gold Corp.

ticker: IAUX


text: Key Principles of the Cybersecurity Risk Management Program: • Risk Management - a proactive approach to identifying and mitigating risks to protect the organization's assets and integrity through third party assessments, internal assessments and global cybersecurity threat analysis. • Defense Strategy - adopts a robust defense approach to protect systems from potential threats, including an assumption of breach mindset. • Zero-Trust Architecture - implements a zero-trust philosophy, ensuring that no entity is inherently trusted without verification. • Least Privileged Access - employ strict identity and access management principles to limit user access based on necessity. • Mitigation and Management of Incidents or Disasters - our risk management program includes policies and procedures for incident response and mitigation.


text: Key Components of the Cybersecurity Program: • Ongoing Detecting and Monitoring - Continuous surveillance of networks to identify threats and intrusions in real-time. • Vulnerability Assessment - Regular assessments conducted by both internal teams and external partners to identify system vulnerabilities. • Employee Training - Regular cybersecurity training and awareness campaigns are undertaken to equip employees with the knowledge needed to mitigate risks. • IT Leadership - The IT Department leads the implementation of the cybersecurity risk management program, ensuring adherence to Company and regulatory standards.


text: Compliance Framework The cybersecurity program aligns with the National Institute of Standards and Technology's Cybersecurity Framework. The IT Department, in collaboration with external vendors, diligently works to detect vulnerabilities, identify compromised devices, and maintain compliance across the organization's IT systems.


text: External Engagement The Company engages with third-party organizations to conduct regular assessments of compliance, controls, and overall risk management strategies, ensuring a comprehensive approach to cybersecurity. Quarterly vulnerability assessments are performed on external and internal systems, as well as a larger annual audit of system security and compliance.


text: Responsibility and Communication The Company promotes a culture where cybersecurity awareness is recognized as everyone's responsibility. Regular communications about cybersecurity risk mitigation and intrusion prevention measures are shared with senior management and the Board of Directors.


text: Incident History The Company has not experienced any cybersecurity incidents during the year ended December 31, 2024, or in any prior year that resulted in interruptions to normal business operations or breaches of systems.


text: IT Director's Role • The IT Director leads the cybersecurity risk management program with over 25 years of experience in managing cybersecurity programs, auditing, and IT operations within the US mining and manufacturing sectors. They possess a bachelor's degree in computer information security and a master's degree in management information systems.


text: Board of Directors Involvement • The Board is actively engaged in overseeing the cybersecurity program, receiving regular updates and assessments concerning governance and compliance. Quarterly updates from the IT Director cover the status of cybersecurity controls, exposures, and overall program results. The Board insists on being informed about any material cybersecurity incidents.


text: This structured overview distills the essence of the cybersecurity risk management and governance processes within the Company, emphasizing the proactive approach to cybersecurity management and the involvement of leadership at all levels.


text: Cybersecurity Risk Management and Strategy We rely extensively on various information systems, operated by us as well as third-party service providers, to manage many aspects of our business. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action.

companyName: Torrid Holdings Inc.

ticker: CURV


text: Accordingly, we recognize the critical importance of protecting and securing these information systems and have implemented multiple layers of cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risk. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Efforts to assess, identify, and manage cybersecurity risk are led by our dedicated Chief Operating Officer ("COO"), and supported by an experienced team, other members of management, and the Board. From time to time, we engage consultants, auditors, and other third parties to assist us in these efforts.


text: We assess our information security program using an industry-leading cybersecurity framework, the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). A risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on us and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: To test our cybersecurity program, we perform periodic vulnerability testing, engage an independent third party to perform periodic internal and external penetration testing, and engage other third parties to conduct periodic assessments of our cybersecurity capabilities. We continuously expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing simulation campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers used in different capacities to provide or operate some of our cybersecurity and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments and external monitoring sources, including performing dark web analyses, to better inform us during contracting and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place that are designed to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups, including the legal and finance functions, the Board, and external breach counsel, and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans for certain critical applications and services to prepare for and respond to the potential for a disruption in the technology we rely on.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Torrid (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems. See "Risks Related to Our Business" in Item 1A, "Risk Factors" in this Annual Report for a discussion of cybersecurity risks that may materially impact us.


text: Based on the information available as of the date of this Annual Report, no material risks from known cybersecurity incidents have, either individually or in the aggregate, materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. There is no guarantee that any risks from cybersecurity threats will not materially affect us in the future.


text: Cybersecurity Governance The Board oversees our overall risk assessment process, where we assess key enterprise risks within the company, and at least quarterly, senior management reviews these risks with the Board. Cybersecurity and other technology risks, which are considered in our enterprise risk management framework, continue to remain a top priority for the Board. Primary oversight responsibility for cybersecurity and other technology risks has been given to the Audit Committee by the Board.


text: Our cybersecurity risk management and strategy processes are led by our COO, assisted by our Vice President of Infrastructure and Operations. Together, they have over 20 years of combined professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and managing multiple industry and regulatory compliance environments.


text: At least quarterly, the Audit Committee, Chief Executive Officer and senior finance and legal management, evaluate, review and discuss with the COO our cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, recent cybersecurity incidents at other companies and the emerging threat landscape. Significant cybersecurity incidents are reviewed and discussed with the Audit Committee and senior finance and legal management as required by our cybersecurity incident response plan.


text: Risk Management and Strategy The Company implements a comprehensive Information Security Program ("Program") to safeguard data confidentiality, integrity, and availability. The Program leverages recognized frameworks like National Institute of Standards and Technology (or NIST) and Federal Financial Institutions Examinations Council ("FFEIC") to identify, prevent, and mitigate cybersecurity threats. Regular assessments and updates ensure the Program's effectiveness in managing and reducing risk.

companyName: California BanCorp \ CA

ticker: BCAL


text: The Program integrates seamlessly with the Company's enterprise risk management program. Continuous threat and vulnerability assessments inform system and control updates, effectively mitigating risks. Layered security controls work together to protect customer information and transactions. Additionally, third-party experts conduct periodic program evaluations through penetration testing, audits, and best practice consultations, with results driving program improvement initiatives. As a regulated entity, California Bank of Commerce undergoes regular bank regulatory examinations evaluating the information security program and its compliance with federal regulations.


text: The Company's third-party risk management program oversees and identifies cybersecurity threats associated with service providers. While visibility into third-party operations is limited, risk-based evaluations are conducted. These evaluations involve reviewing security assessment questionnaires, testing summaries, audit reports, and information security policies.


text: Recognizing the importance of continuous security awareness, the Company provides comprehensive employee training. This includes mandatory cybersecurity and fraud training at onboarding, monthly email phishing tests, and annual computer-based training.


text: In addition, the Company has an incident response plan ("IRP") that is in effect if an event is identified by information technology or information security team or one of our third party vendors. The Company's Information Security Officer ("ISO") would activate the IRP and communicate with the team members in accordance with the IRP. If the incident is material, the Chief Risk Officer would disclose the incident to the management Disclosure Control Committee.


text: While no material cybersecurity incidents have been identified during the reported fiscal year, the Company acknowledges the ongoing and evolving nature of cyber threats and remains vigilant in its efforts to defend against them.


text: The Company's internal controls incorporate a protocol for reporting and escalating information security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board oversees continuous efforts to strengthen operational resilience and receives ongoing education to enhance their oversight capabilities in the face of evolving threats. The ISO, who reports directly to the Chief Risk Officer, periodically updates the Company's Information Technology Committee, the Company's Audit and Risk Committee ("ARC Committee") and the Board of Directors on information and cybersecurity risks, threats, exposures, and mitigation measures. The Company's IRP is regularly tested, incorporating cybersecurity scenarios.


text: The ISO leads program development, implementation, and reporting to the Board. The ISO possesses extensive experience with over 25 years of securing information systems and data, and holds many industry certifications including Microsoft Certified Software Engineer + Security, Exchange Security, Comptia Security+, Pentest+, Cyber Security Analyst(CYSA+), Cisco Certified Network Admin + Security enhancement, Cisco Certified Design architect and Certified Ethical Hacker. Recognizing cybersecurity as a shared responsibility, the Company conducts periodic management-level simulations and tabletop exercises with external resources and advisors as needed.


text: The Board of Directors provides ultimate oversight and monitoring of the Program and its policies. The ARC Committee oversee areas like information technology activities, cybersecurity-related risks, and disaster recovery processes. Additionally, management-level technology and security personnel oversee program management and related assessments, while operational committees manage specific cybersecurity-related risks.


text: Risk Management and Strategy The Company has developed and implemented a cybersecurity program (the "Program") designed to identify, assess, and mitigate material cybersecurity related risks. The Company's program leverages recognized frameworks and standards, including the National Institute of Standards and Technology, Cyber Security Framework, the Center for Internet Security Critical Security Controls, and the Payment Card Industry Data Security Standards, to assess, organize, and improve our program. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we leverage various security standards, guidelines and best practices to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: As part of the Program, the Company maintains various safeguards to help protect the confidentiality, integrity, and availability of its information systems and data, including: • layered technical controls designed to help detect, prevent, and mitigate cybersecurity threats to Company assets; • utilization of a third-party managed detection and response service provider to monitor for cybersecurity threats, ingest threat-intelligence, and coordinate incident response efforts; • policies, procedures, and standards that are utilized to outline the Company's expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity training and education for our employees; • practices for monitoring cybersecurity risks of key third-party service providers; and • incident response plans that provide a framework for the Company's response to cybersecurity incidents.


text: From time to time, the Company engages third-party subject matter experts and consultants to conduct evaluations of our program and security controls, whether through penetration testing, assessments, or consulting on best practices to address new challenges. Results are used to identify and assess risks as well as drive priorities and initiatives to improve the overall Program. The Company also engages third-party experts and consultants, when deemed appropriate, to assist with responding to cybersecurity incidents, such as external legal counsel and forensic specialists.


text: In addition, assessing, identifying, and managing cybersecurity-related risks are integrated into our overall enterprise risk management ("ERM") process. Cybersecurity risks are included in the risk universe that the ERM function evaluates, with input from information security subject matter experts at the Company, to assess top risks to the enterprise. The ERM process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. By integrating cybersecurity risk into the overall ERM process in this manner, the Company is better equipped to identify, assess, and manage material cybersecurity risks.


text: During the period of this Annual Report, the business strategy, results of operations and financial condition of the Company have not been materially affected by risks from any known cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Risks Related to Information Technology and Cybersecurity at Item 1A. Risk Factors.


text: The Company's Information Systems organization, which is led by the Chief Information Officer ("CIO"), is responsible for implementing and maintaining the Company's Program and related risk management. The Company's current CIO has formal education in information technology and extensive work experience gained from over 20 years in various technology leadership roles. As leader of the Company's information systems and technology function, the CIO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation. The team responsible for developing and executing its cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or significant experience working in information technology and cybersecurity, including relevant industry experience in security related industries.


text: Our Board considers cybersecurity risk as part of its risk management oversight function. The Audit Committee assists the Board in its oversight of cybersecurity risks and receives regular updates from the CIO and other Company management on cybersecurity matters at least annually. The Audit Committee reports findings and recommendations, as appropriate, to the full Board for consideration. The Audit Committee also receives information about cybersecurity risks as part of the Company's ERM program and reporting. In addition, any cybersecurity incident assessed as being, or potentially becoming, material is escalated for further assessment and then reported to designated members of our senior management and, if necessary, the Audit Committee.


text: Cybersecurity is an important part of our risk management program for our Board of Directors and management. Our Board of Directors, through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee, comprised solely of independent directors, is charged with overseeing the Company's risk management program, including cybersecurity matters.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: The Company also maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through internal management and external service providers. Our cybersecurity risk management and strategy processes are led by our Chief Administrative Officer. This individual has over 30 years of prior work experience in various roles involving managing information systems and security, developing information security strategy, implementing effective information and cybersecurity programs, as well as a degree focusing on computer science. The Chief Administrative Officer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management and participation in the Company's cybersecurity risk management and strategy processes including the operation of our incident response plan. This management team member routinely discusses trends in cyber risks and our strategy with management and reports to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. Our information security program includes, among other aspects, antivirus and malware protection, encryption and access control, and employee training. Risks identified by the Chief Administrative Officer and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed.


text: In addition, we engage independent third-party cybersecurity providers for testing and vulnerability detection. We regularly engage with these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and provide security awareness training and supplemental training as needed.


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Lovesac Co

ticker: LOVE


text: The Company is committed to protecting its information system and data from cyber threats. We utilize third party technical tools to control system access and filter, restrict and regulate content that may pose a material risk to the Company. Employees are required to use multi-factor authentication to access Company systems and undergo annual security training. Management is responsible for identifying, monitoring and mitigating the material risks facing the Company, including cybersecurity risks. Management provides regular reports to the Board at every meeting to review our top risks, identify trends and help manage risk.


text: Our cybersecurity risk management and strategy is overseen by our Chief Information Officer as well as other members of the senior leadership team at Lovesac. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents and report to the Board on any appropriate items. Our Chief Information Officer has over 35 years of experience managing information technology and cybersecurity matters and is responsible for assessing and managing these cybersecurity risks. Team members who support our information security program have relevant educational and industry experience.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management and an area of focus for our Board and management. Our Board of Directors is responsible for the risk oversight of the Company, including cybersecurity risks. The Board receives updates on a quarterly basis from senior management, including leaders from our Information Technology and Security, Risk Management. Finance, and Legal teams and our Chief Information Officer regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. The Audit Committee of the Company's Board of Directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Board of Directors, as a whole and at the Audit Committee level, oversee the most significant risks facing the Company and our processes to identify, prioritize, assess, manage and mitigate those risks.


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risk. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Audit Committee receives reports, briefings and presentations from senior management, including our Chief Information Officer, at periodic committee meetings, including, more in-depth presentations on specific areas of risk and regular enterprise risk management updates.


text: Although the Company endeavors to mitigate cybersecurity risks, the nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Legal, Tax and Regulatory Risks."


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: TILLY'S, INC.

ticker: TLYS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating and Corporate Governance Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer and/or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Chief Information Officer is responsible for assessing and managing our material risks from cybersecurity threats. He has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Information about cybersecurity risks and Innventure's risk management processes is collected, analyzed and considered as part of Innventure's overall enterprise risk management program. In connection with Innventure's risk management process, the Audit Committee of the Board (the "Audit Committee") discusses with management and the independent auditors the Company's underlying policies and guidelines with respect to risk assessment and risk management, including with respect to cybersecurity.

companyName: Innventure, Inc.

ticker: INV


text: Innventure is in the process of implementing measures to mitigate potential risks associated with information technology disruptions and cybersecurity threats, and Innventure plans to periodically assesses these risks, implements controls, and performs business continuity and disaster recovery planning. Innventure's current risk management efforts include threat intelligence gathering, vulnerability assessments, and the integration of cybersecurity technologies. These measures are designed to help protect Innventure's proprietary systems and customer data from both internal and external cybersecurity threats.


text: Innventure engages third parties to perform various cybersecurity services and risk assessments. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, Innventure performs diligence on third-party service providers that provide critical data.


text: As of the date of this Form 10-K, Innventure has not identified risks as a result of prior cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, Innventure's operations, business strategy, results of operations, or financial condition. Innventure faces certain ongoing risks from cybersecurity threats and interruptions that, if realized, are reasonably likely to have a material adverse effect on Innventure's business, financial condition, results of operation, and prospects. See "Risk Factors—Cyber-attacks or a failure in Innventure's information technology and data security infrastructure could adversely affect Innventure's business and operations."


text: Cybersecurity Governance The Audit Committee is responsible for overseeing the Company's guidelines and policies with respect to risk assessment and risk management to assess and manage the Company's exposure to enterprise risk. The Audit Committee periodically reviews and discusses with management the Company's policies with respect to risk assessment and risk management, including but not limited to cybersecurity and enterprise risk, and steps management has taken to monitor and control such exposures.


text: Our Vice President, Finance is responsible for assessing and managing risks from cybersecurity threats. Innventure's Vice President, Finance has a Bachelor's degree in Accounting and a Master of Business Administration degree. Our Vice President, Finance is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from an external consultant. The external consultant has 20 years of cybersecurity experience. The external consultant also has an Associate's degree in Database Administration and Network and System Administration. The external consultant also maintains the industry-recognized CompTIA Security+ certification. The Vice President, Finance reports any exposure to risks from cybersecurity threats to our CFO. The Company intends for the CFO to regularly provide updates on risks related to cybersecurity to the Audit Committee.


text: The Company maintains a cybersecurity and risk management program called the Information Security Management Program ("ISMP") designed to identify, assess, manage, mitigate and respond to cybersecurity threats and attacks. The ISMP is overseen by the Company's Chief Compliance and Privacy Officer, who oversees the Company's information technology security team as it relates to the ISMP and is responsible for assessing and managing the ISMP, informs senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Company.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: The ISMP was developed by the Company's information security team in collaboration with cross functional stakeholders, and is designed to ensure the organization's security posture and practices are in alignment with contractual, regulatory and industry requirements. Risk assessments against specified criteria are conducted no less than annually, and sooner if there are significant changes in the environment. Security services are delivered through a combination of internal and third party resources. Formal periodic meetings are held with Company's executive leadership to review relevant components of the ISMP, formal annual reviews of the policies are conducted, formal reviews of the entire ISMP and risk register are conducted at least annually, and more frequently if there are significant changes to the environment. Also, an independent review of the ISMP is conducted in the following ways: (i) an annual Health Insurance Portability and Accountability Act (HIPAA) risk assessment conducted by a third party; and (ii) a Health Information Trust Alliance (HITRUST) risk based two year assessment conducted by a third party.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Company's cybersecurity team briefs the Audit Committee on the effectiveness of the Company's cybersecurity risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Company's Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.


text: We have, from time to time, experienced threats to and breaches of our data and systems, including breaches of our data within third party vendor's system. As of the filing date of this report, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, security breaches, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A of this report.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Our information security function, which includes our Vice President of Information Technology ("IT") and third-party service providers, legal department and security committee, helps identify, assess, and manage the Company's cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: using automated tools, conducting audits, evaluating threats, and performing vulnerability assessments.


text: Depending on the environment, systems, and data at issue, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: cybersecurity insurance, physical security, incident detection and response, access controls, employee training, penetration testing, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Vice President of IT, works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and supply chain resources. We have a vendor management process to manage cybersecurity risks associated with certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of diligence designed to help identify cybersecurity risks associated with a provider such as risk assessments and reviewing security assessments and reports.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled: If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; material disruption of our product development programs; and other adverse consequences.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of IT, who holds a Bachelor of Science in Computer Methods from California State University-Long Beach and has previously served as a Director and Associate Director of IT for large pharmaceutical companies.


text: Our management, including our Chief Operating Officer and Vice President of IT, is responsible for hiring appropriate information security personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and helping prepare for cybersecurity incidents.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Vice President of IT and General Counsel, who work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Board of Directors receives periodic reports from the management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk Management and Strategy We have implemented a cybersecurity program for assessing, identifying, and managing cybersecurity risks aligned with the National Institute of Standard and Technology Cybersecurity Framework (NIST CSF) and where appropriate we have integrated these processes into our enterprise risk management framework. We have implemented administrative, technical, and physical safeguards designed to protect our information systems and protect the confidentiality, integrity, and availability of our data. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection.

companyName: LanzaTech Global, Inc.

ticker: LNZA


text: We engage external parties, such as consultants, to enhance our cybersecurity oversight as required. We conduct periodic risk assessments to evaluate our cybersecurity posture, including through annual third-party vulnerability assessment and penetration tests performed by reputable service providers. We conduct risk assessments, as appropriate, on critical third parties who maintain material data or information to help assess and validate the information security capabilities of these third parties. We maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. We also have implemented administrative, technical, and physical safeguards designed to protect our information systems and protect the confidentiality, integrity, and availability of our data.


text: Governance Related to Cyber Security Risks The Audit Committee of the Board has oversight of management's efforts with respect to IT systems and cybersecurity. As part of this oversight, our Chief Information Security Officer ("CISO") shares quarterly updates regarding any changes around our cybersecurity defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively address these threats with the Audit Committee. During these meetings, the CISO provides the Audit Committee updates regarding any changes around our cyber defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively address these threats. Our Board has delegated primary responsibility for the oversight of cybersecurity matters to the Audit Committee; however, the full Board reviews significant cybersecurity matters as appropriate. The Audit Committee provides updates to the Board on a quarterly basis on the activities that the Audit Committee oversees, including Cybersecurity.


text: Our Chief Information Security Officer is responsible for strengthening and continuously monitoring the effectiveness of our cybersecurity program. The individual currently serving in the role of Chief Information Security Officer has over 30 years of information systems and cybersecurity experience within complex and international business verticals such as technology, financial services, biotech, and other scientific organizations. He also holds the Certified Information Systems Security Professional (CISSP) certification. In addition, our cybersecurity steering committee assists in managing certain technical aspects related to cybersecurity. Our cybersecurity steering committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through monthly meetings and frequent communications. Regular members of the steering committee consist of participants from the IT infrastructure, Business Systems, AI and Modelling and Scientific Computing teams. Participants from other teams attend on an as-needed basis.


text: To date, we have not identified any indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. However, as discussed more fully under "Item 1A. Risk Factors", the sophistication of cyber threats continues to increase and we cannot assure that our systems and processes will be successful, that we will be able to anticipate or detect all cyberattacks or other breaches, that we will be able to react to cyberattacks or other breaches in a timely manner or that our remediation efforts will be successful.


text: Risk Management and Strategy We consider cybersecurity and privacy to be important issues affecting the enterprise both in terms of reputational risk and economic risk. To effectively assess, identify, and manage material risks from cybersecurity threats, we maintain a cybersecurity risk management program, which is led by our Chief Technology, Logistics & Stores Officer ("CTO") and our Vice President, Information Security & IT Risk ("VP, IT"), as a part of the Company's overall risk management and compliance programs. To keep pace with ever-evolving threats and industry best practices, we have made, and will continue to make, sizable investments in building and developing cybersecurity talent and expertise and implementing state-of-the-art systems and tools, to detect, identify, classify and mitigate cybersecurity and other data privacy risks within our environment. We employ benchmarking to understand best practices and industry trends. We conduct security and compliance assessments throughout each year to validate the efficacy of our programs and practices. We also engage an independent third party expert to assess our cybersecurity maturity periodically against the retail industry. The results of these assessments inform our cybersecurity development roadmap going forward and are presented to the Audit Committee and the Board of Directors. We also maintain cybersecurity insurance as part of our comprehensive insurance portfolio.

companyName: Childrens Place, Inc.

ticker: PLCE


text: We believe that we employ appropriate standards, guidelines and best practices to manage cybersecurity-related risk and have implemented comprehensive controls consistent with the requirements of the International Organization for Standardization ("ISO") and assess our cybersecurity maturity levels against the National Institute of Standards and Technology ("NIST") framework, including, but not limited to, the following: • Intrusion prevention controls (such as network segmentation and firewalls); • Access controls (such as identity and access management and multi-factor authentication on critical applications and systems); • Detection controls (such as endpoint threat detection and response, and logging and monitoring involving the use of a third-party for security information and event management, with reports and alerts provided by the third-party to the CTO's team); and • Threat protection controls (such as mandatory cyber-threat training and simulated phishing campaigns with employees, vendor management programs, and vulnerability and patch management).


text: In an effort to ensure that our associates are knowledgeable about our data security and protection policies, and to enable them to proficiently handle the threat of cyber-attacks, all associates are required to participate in a cybersecurity awareness training program annually. Financial, IT and other associates who have access to sensitive information are also required to attend additional training courses during the year. We also conduct frequent phishing simulations throughout the year to test our employees' responses to suspicious emails and to better inform our cyber awareness training program.


text: We circulate cyber awareness materials on a periodic basis on our intranet and hold a "Cyber Awareness Month" each year to promote the importance of cybersecurity topics. In addition, members of senior management participate in periodic crisis management exercises with third-party experts on crisis management best practices to apply their learnings to the Company's business continuity management program. In particular, in Fiscal 2023, the table-top exercise that was conducted for senior management focused on the handling of a cyber-security incident.


text: Because we are aware of the risks associated with third-party service providers, we also have implemented processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to help ensure compliance with our cybersecurity standards. In addition, we perform periodic risk assessments of key vendors. This approach is designed to mitigate risks related to potential data breaches or other security incidents originating from or at third-party service providers.


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. As of Fiscal 2024, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For more information about the Company's assessment of cybersecurity risks, see the risk factor titled "A privacy breach, through a cybersecurity incident or otherwise, or failure to comply with privacy laws could have a material adverse effect on our business" in Part I, Item 1A, "Risk Factors".


text: We are committed to maintaining the trust we have established with our customers and associates. They expect that we will protect their personal information. Our comprehensive privacy program includes standards and practices focused on keeping data we collect secure and reflects our commitment to respecting privacy rights. Our Privacy Policy is available on our website and we continually assess and update this Policy to reflect industry best practices and applicable laws and regulations.


text: Our Board of Directors recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, as well as non-public information about our Company. Although the Board of Directors as a whole is ultimately responsible for the oversight of our risk management function, the Board of Directors uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for our cybersecurity risk identification and mitigation activities, and that Committee and senior management provide reports regularly to the Board of Directors.


text: The Audit Committee receives periodic reports from management, including our CTO and VP, IT. These reports encompass a broad range of topics, such as our cybersecurity risks, the current cybersecurity landscape and the status of ongoing cybersecurity initiatives. Furthermore, management informs the Audit Committee as deemed necessary, about any notable cybersecurity incidents.


text: Our management team, including our CTO and VP, IT, is responsible for assessing and managing our material risks from cybersecurity threats. The VP, IT's team has primary responsibility for the day-to-day operation and implementation of our overall cybersecurity risk management program and supervises both our internal cybersecurity team and our retained external cybersecurity consultants. The VP, IT's team also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our CTO's background includes more than 20 years of experience in the technology domain, with 15 years in the retail industry, leading e-commerce implementations and large scale transformation projects such as adopting cybersecurity best practices. Our VP, IT has more than 30 years of experience implementing security in complex manufacturing and retail environments. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.


text: The Company's management maintains and implements a written Cyber Security Incident Response Policy and Cyber Security Incident Response Plan, both of which are reviewed and updated on a periodic basis. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, the Audit Committee, our Board of Directors, other stakeholders and law enforcement when responding to such issues.


text: Our cybersecurity program includes the assessment, identification and management of material risks from cybersecurity threats (as defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, our annual enterprise risk management assessment considers risks from cybersecurity threats alongside other risks as part of our overall risk assessment process. In addition, we engage with consultants, internal and external auditors and other third parties to gather certain insights designed to identify and assess material risks from cybersecurity threats, their severity and potential mitigations. We also employ a range of tools and services, depending on the environment, including network and endpoint monitoring, malware detection, vulnerability assessments, cloud penetration testing, threat hunting and incident responsiveness, as well as tabletop exercises, to inform our cybersecurity risk identification and assessment. As part of our cybersecurity program, we maintain an incident response plan that includes processes to assess the severity of, escalate, contain, investigate and remediate cybersecurity incidents. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Aircastle LTD

ticker: AYR


text: Our Board of Directors has delegated oversight of our cybersecurity program, which includes oversight of cybersecurity threats, to the Risk and Governance Committee. Throughout the year, at each quarterly Risk and Governance Committee meeting, or as needed, the committee is updated on IT security by senior management, including industry IT breaches, cybersecurity incidents and employee cybersecurity training. Our SVP, IT Operations & Security, is a Certified Information Systems Security Professional who has provided technology-related infrastructure and application management services for over 25 years and is responsible for day-to-day assessment and management of our information systems and cybersecurity program. Our SVP, IT Operations and Security, reports directly to our Chief Financial Officer.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and, we believe, are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional description of risks from cybersecurity threats and potential related impacts on the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "We are dependent upon information technology systems, which are subject to disruption, damage, failure and risks associated with implementation and integration."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and SOC 2 trust principles on security. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers that includes a diligence and contracting process depending on our assessment of each provider's respective criticality and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Because our products collect and store visitor and related information and images, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could result in additional costs and liabilities to us or inhibit sales of our products."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Audit Committee") oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from our Vice President of Cybersecurity and Information Technology on our cybersecurity risks, updates, as necessary, regarding any cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our Vice President of Cybersecurity and Information Technology is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and Information Technology has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and Information Technology was the Leader of Global Information Security for New Balance.


text: Our Vice President of Cybersecurity and Information Technology supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy NetScout has implemented and maintains information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information, and the information of our customers and employees ("Information Systems and Data").

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Our Cybersecurity Executive Council ("Council"), which is led by the Chief Information Security Officer ("CISO") and includes our Chief Information Officer ("CIO"), Chief Operating Officer ("COO"), General Counsel ("GC"), Chief Compliance Officer ("CCO"), SVP of Research & Development, Senior Director of Engineering, SVP of Global Services Operations, and AVP of Engineering, oversees NetScout's cybersecurity program, including strategy, threats, risks, and mitigations. The CISO, who reports to the CIO, and the Senior Director of Engineering, who reports to the SVP of Research and Development, with oversight by the Council, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and NetScout's risk profile using various methods such as implementing manual and automated tools, subscribing to services that identify cybersecurity threats, analyzing reports of certain threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, conducting audits and threat assessments, conducting vulnerability assessments to identify vulnerabilities, and engaging in tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, among other things: incident response, identity and access management, vulnerability management, logging and systems monitoring, disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls for certain systems; data segregation and access controls for certain systems; physical security measures; asset management; annual employee training; certain testing; and IT and software development lifecycle training. NetScout also employs certain proprietary detection tools, enabling enhanced visibility and warning systems in response to certain cybersecurity threats.


text: We also use third-party service providers to assist us from time to time to identify, assess, audit and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and certain testing firms.


text: We use third-party service providers to perform a variety of other functions throughout our business, such as application providers, hosting companies, and supply chain resources (such as shipping). We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve risk assessments, data privacy and security questionnaires, risk assessments, and imposition of cybersecurity-related contractual obligations on the vendor.


text: Our risk-based assessment and management of material risks from cybersecurity threats are integrated into NetScout's overall risk management processes. Cybersecurity risks are addressed as a component of NetScout's enterprise risk management program and our enterprise risk management processes include an Enterprise Risk Management Steering Committee ("Steering Committee"), led by the CCO and includes all members of the Council as well as other members of management, that meets quarterly and considers ways to mitigate cybersecurity threats that are more likely to lead to a material impact to our business. The Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and provides a risk register report to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: Our Board of Directors addresses NetScout's cybersecurity risk management as part of its oversight function. The Board of Directors' Audit Committee is responsible for overseeing NetScout's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our Council, in turn, oversees management's cybersecurity efforts.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of NetScout's management, including our CISO, who reports to the CIO and has over 25 years of experience, the CCO, who reports to the General Counsel, and the Senior Director of Engineering, who reports to the SVP of Research and Development, for security.


text: The CISO and Senior Director of Engineering are each responsible for helping to integrate cybersecurity risk considerations into NetScout's overall risk management strategy and communicating key priorities to relevant personnel. The CISO and Senior Director of Engineering are also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy and plan are designed to escalate certain cybersecurity incidents to a Security Incident Response Team ("SIRT"), comprised of the CIO, CISO, GC, CCO and Senior Director of Engineering. The SIRT works with NetScout's incident response team to help NetScout mitigate and remediate cybersecurity incidents of which they are notified. In addition, NetScout's incident response plan includes reporting to the CEO and Chair of the Audit Committee of the Board of Directors for certain cybersecurity incidents. NetScout's Cybersecurity Disclosure Committee, which includes the SIRT and the Chief Financial Officer, assess the materiality of cybersecurity incidents for potential disclosure requirements according to an escalation process defined in NetScout's Cybersecurity Protocol for Disclosure Controls and Procedures.


text: The Board of Directors receives quarterly reports from the CISO and CIO concerning NetScout's significant cybersecurity threats and risk and the processes NetScout has implemented to address them. The Board of Directors also receives various reports, summaries and presentations related to cybersecurity strategy, threats, risk and mitigation.


text: To date, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. For a description of the risks from cybersecurity threats that may materially affect NetScout and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report.


text: Risk Management and Strategy Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal information security program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: a.we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology cybersecurity framework and the International Organization for Standardization ("ISO");

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: b.we maintain a dedicated cybersecurity team under the direction of our Chief Technology Officer ("CTO") and supported by our Chief Information Security Officer ("CISO"), each of whom has expertise related to data and network security, data governance and risk management; c.we regularly test our internal IT controls; d.we regularly conduct internal vulnerability assessments as well as third-party penetration tests;


text: e.we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; f.we conduct pre-engagement and targeted recurring reviews of the security controls and security-compliance posture of applicable third-party service providers; g.all employees are required to complete periodic trainings that cover security and privacy best practices and company policies;


text: h.we regularly review our business continuity and other back-up plans, including as they relate to cybersecurity incidents; and i.we perform periodic simulations of attack scenarios by an internal "Red Team" to test the efficacy of both security controls and our tactical incident response procedures.


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our information security program, including our auditors, independent assessors (for example, for penetration testing) of our cybersecurity program, internal and external legal counsel, and other consultants.


text: We have a documented incident monitoring, escalation and reporting process and procedure that we believe to be effective in detecting and analyzing cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: a.continual monitoring of our systems and logs by both dedicated cybersecurity internal and outsourced staff;


text: b.immediate escalation to and review by our CISO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments;


text: c.if deemed appropriate, reporting by our CISO to the Company's Management and its Disclosure Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and d.informing the Audit Committee of our Board of significant or material cybersecurity incidents, as appropriate.


text: All incidents are documented and recorded and catalogued for further review by the CISO and their team. Incidents that are deemed to be significant and/or rise to the level of a "security breach" are documented in a security incident register as part of our established vulnerability monitoring and incident response procedures.


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. We have faced—and in the future may face—sophisticated attacks, including attacks referred to as advanced persistent threats, which are cyberattacks aimed at compromising our intellectual property and other commercially sensitive information, such as the source code and game assets for our software or confidential customer or employee information, which may remain undetected for prolonged periods of time. In September 2022, we experienced a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from Rockstar Games' systems, including early development footage for the next Grand Theft Auto. Subsequently, also in September 2022, an unauthorized third party illegally accessed credentials for a vendor platform that 2K Games uses to provide help desk support to its customers. The unauthorized party sent a communication to certain players containing a malicious link. 2K Games immediately notified all affected users and took steps to restrict further unauthorized activity until service was restored. In connection with this activity, we have incurred certain immaterial incremental one-time costs related to consultants, experts and data recovery efforts and we generally expect to incur additional costs related to cybersecurity protections in the future.


text: In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, reputational harm, and loss of investor confidence. See Item 1A, Risk Factors, for more information on the cybersecurity threats facing our Company.


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including, through the Audit Committee, cybersecurity and information security risk management and controls. As part of its oversight function, the Board, directly and through its Audit Committee, oversees the Company's risk assessment and risk management policies, including related to cybersecurity. At least quarterly (with respect to the Audit Committee) and annually (with respect to the Board), our CTO and CISO report to the Audit Committee or the Board, respectively, addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CTO and CISO have primary responsibility for managing our information security program and efforts, including with respect to cybersecurity. They work closely with key stakeholders, including internal committees such as our Cyber Steering Group, peer institutions, and industry groups, in order to manage cybersecurity and information security risk. Our internal audit team is responsible for testing and auditing our information-technology internal controls. In addition, leaders from our communications, finance, legal and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency.


text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and relevant training and certifications, such as Certified Information Systems Security Professional certification, ISO 27001 certification, and other technical cybersecurity certifications from ISC2, the SANs Institute and OffSec as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.