text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by head of administration and our managed service provider. Our head of administration has over four years of experience addressing cybersecurity risks. Our head of administration is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our head of administration oversees the Incident Response Plan and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: In its oversight role, our Board of Directors is expected to specifically consider risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT

secItem: Item 1C


text: On a regular basis, the head of administration reports to our Board of Directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our Board of Directors for consideration.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected our business, financial condition, results of operations, cash flows and prospects or that are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item IA—Risk Factors—Risks Related to Our Business."


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Our share of Bitcoins mined from our pools are initially received by us in wallets we control. We currently sell the majority of the Bitcoin we mine and utilize hot wallets to hold this Bitcoin immediately prior to selling for working capital purposes. We hold any remainder of our Bitcoin in cold storage. Bitcoins we mine or hold for our own account may be subject to loss, theft or restriction on access. Hackers or malicious actors may launch attacks to steal, compromise or secure Bitcoins, such as by attacking the Bitcoin network source code, exchange miners, third-party platforms (including Gemini), cold and hot storage locations or software, or by other means. We may be in control and possession of substantial holdings of Bitcoin, and as we increase in size, we may become a more appealing target of hackers, malware, cyber-attacks or other security threats.

companyName: LM FUNDING AMERICA, INC.

ticker: LMFA


text: Our management evaluates all cybersecurity matters, with the purpose of meeting at least semi-annually and providing recommendations with respect to our information technology use and protection, including, but not limited to, data governance, privacy, compliance and cybersecurity. We have implemented controls, policies, procedures and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of our IT systems and data that we believe to be reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. We are also required to comply with applicable laws, rules, regulations and contractual obligations relating to the privacy and security of our IT systems and data and to the protection of such IT systems and data from unauthorized use, access, misappropriation or modification.


text: To our knowledge there has been no security breach or incident, unauthorized access or disclosure, or other compromise of or relating to the Company or its subsidiaries hard wallets, cold wallets, information technology and computer systems, networks, hardware, software, data and databases, equipment or technology. We have not been notified of, and have no knowledge of any event or condition that could result in, any security breach or incident, unauthorized access or disclosure or other compromise to their IT systems and data, and we have implemented appropriate controls, policies, procedures, and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of our IT systems and Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. We are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT systems and data and to the protection of such IT systems and data from unauthorized use, access, misappropriation or modification.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk and other information technology risks as part of its risk oversight function and meets at least quarterly to discuss matters involving cybersecurity risks. The Chief Executive Officer and Chief Financial Officer provide information to our Board of Directors regarding its activities, including those related to cybersecurity risks, and are responsible for notifying the Board of material cybersecurity incidents.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management ("ERM") approach, which is subject to oversight by our Board of Directors (the "BOD").

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a cybersecurity program that endeavors to identify risks, protect assets, detect threats, respond to incidents, and recover from damaging events in a prompt and effective manner with the goal of minimizing business disruptions through effective governance of people, processes, and technologies. • External Collaboration: We collaborate with third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats, including compromises of our information systems and our data's confidentiality, integrity, and availability. These include firewalls, disaster recovery capabilities, malware and ransomware prevention, access controls, and encryption. • Education: We provide monthly training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Incident Response Planning: We have established and maintain incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which a material incident would be communicated to executive management, our BOD, external regulators and shareholders. • Governance: Our BOD's oversight of cybersecurity risk management is led by the Company's Audit Committee, which oversees our ERM program. Cybersecurity threats, risks and mitigation are reviewed by the Audit Committee on at least an annual basis and such reviews include internal and independent assessment of risks, controls and overall program effectiveness.


text: Our risk assessment efforts have indicated that we are a potential target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized criminal groups, malicious insiders and activists. The impacts of attacks, abuse and misuse of the Company's systems and information include, without limitation, loss of assets, operational disruption and damage to the Company's reputation.


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through assessments and other exercises focused on evaluating the sufficiency and effectiveness of our cybersecurity risk management efforts. If a material weakness in our cybersecurity risk management program is identified, it will be reported to the Audit Committee and the BOD, as appropriate, and we will make adjustments to our cybersecurity processes and practices as necessary to eliminate or compensate for that weakness.


text: Our CFO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other Company management. We believe our business leaders, including our CFO, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our CFO collaborates with other Company business leaders to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents.


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to operationalize our cybersecurity risk management program. The Audit Committee will promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates. The Audit Committee periodically discusses our approach to cybersecurity risk management with our CFO, who oversees the Company's information systems.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition at this time.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending VII LLC


text: Cybersecurity Risk Management and Strategy The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CISO has served in various roles in information technology and information security for many years and holds relevant professional certifications. The Adviser's COO and CCO each hold educational and professional degrees in their respective fields, and each has numerous years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: In the ordinary course of our business, we use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology vendor, which is overseen by our Senior Vice President of Administration, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability and data penetration testing, regularly review third party audits of our cloud-based technology vendors and perform ongoing regular risk assessments. We also conduct periodic employee training on cyber and information security, among other topics. In addition, to our third-party information technology vendor, we also consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: Our Senior Vice President of Administration who reports directly to the Chief Executive Officer and has over seven years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in "PART I, ITEM 1A, RISK FACTORS," under the heading "If we experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: The Board of Directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board receives at least quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President, Administration as well as other members of the senior leadership team.


text: Risk management and strategy We rely on our information technology to operate our business and understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis, we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify and manage material risks.

companyName: T2 Biosystems, Inc.

ticker: TTOO


text: As part of our broader risk management framework, we have identified potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication and recovery plans in the event of a cybersecurity threat or incident.


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework, and we are engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all critical third-party providers to help ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Our Board of Directors has assigned specific oversight responsibility for cybersecurity to our Audit Committee. The Audit Committee reviews and discusses with management our policies, practices and risks related to information security and cybersecurity. Our General Counsel has primary responsibility for assessing, monitoring and managing cybersecurity risks.


text: Our General Counsel provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.


text: Risk Management and Strategy We are committed to safeguarding the personal information of our customers and potential customers as well as our own sensitive data and information. The full Board of Directors (the "Board") is responsible for the Company's general risk oversight, including cybersecurity and data privacy risks. Members of the Company's senior management also have day-to-day responsibility for risk management and establishing risk management practices. The Board oversees senior management in their risk management capacities, regularly reviewing and analyzing the Company's risk levels and reviewing and analyzing inventory risk each quarter as part of their review of quarterly financial statements. Members of the Company's senior management have an open line of communication to the Board and have the discretion to raise issues from time-to-time in any manner they deem appropriate.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: The Audit Committee supports the Board by considering and reviewing the adequacy of the Company's internal controls with management and the Company's internal audit department, including the processes for identifying significant cybersecurity/data privacy risks or exposures, and elicits recommendations for the improvements to such procedures where desirable. The Audit Committee periodically reviews the Company's data security and privacy policies, procedures and risks. Members of management are expected to report matters to the Audit Committee or to the Board as a whole, as appropriate. Management's reporting on issues relating to risk management typically occurs through direct communication with directors or committee members as matters requiring attention arise.


text: We maintain a Data Privacy & Security working group that is responsible for setting data security and privacy policies, overseeing those policies, and tracking and reporting on data security and privacy performance. The working group is comprised of our Chief Information Security Officer, Global Data Privacy Officer, Chief Administrative Officer, and General Counsel. The working group reports to the Audit Committee at least annually. In addition, the Company has an Impact Committee that maintains functional working groups that focus on a number of issues, including Data Privacy & Security. The Impact Committee reports to the Board at least annually. The Company's Global Data Privacy Officer also reports to the Audit Committee at least quarterly and provides the Audit Committee with updates regarding the Company's data privacy environment. We also have a Chief Information Security Officer who reports to the Audit Committee at least annually regarding the Company's data security environment.


text: Our Chief Information Security Officer is certified as a Certified Information Systems Security Professional (CISSP) and has significant experience in monitoring, implementation and management within the disciplines of information and personal data security, disaster recovery, and asset management. He has over 10 years of service in U.S. Army Cyber Operations and within U.S. Army Cyber Command. Our Global Data Privacy Officer has served as our head of Internal Audit for nearly 10 years and has received privacy-related certifications from the International Association of Privacy Professionals (IAPP) including Certified Information Privacy Manager (CIPM) and Certified Information Privacy Professional / Europe (CIPP/e).


text: We perform an annual training exercise for all employees and hold several cybersecurity awareness campaigns throughout the year. Where deemed appropriate, we engage independent security professionals to evaluate the Company's security environment. For example, we comply with Payment Card Industry Standards and are audited annually by a third party to confirm compliance with those Standards. In addition, the Company employs third party penetration testers to identify potential security weaknesses for evaluation and remediation. We also partner with government organizations and industry associations to share intelligence and quickly respond to emergent threats.


text: In order to identify, assess, protect, detect, respond to and recover from cybersecurity threats, we seek to employ multiple industry best practices, processes and controls to minimize the personal information in our possession, including pseudonymization, anonymization, tokenization and encryption. In addition, the Company maintains technical and organizational measures to ensure that personal information is accessible only by authorized personnel. In the event of a data breach, the Company is committed to notifying impacted customers and/or appropriate government entities in accordance with applicable law without unreasonable delay and in all events within the time period specified by applicable law.


text: The Company plans to use reasonable, cost effective, and secure methods for notifications in the event of a data breach. While we have experienced and may continue to experience certain cybersecurity incidents, we do not believe any such incidents incurred to date have materially affected our Company, results of operations, or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A — "Risk Factors — Operational Risks — 'If we are unable to safeguard against security breaches with respect to our information technology systems, our business and our reputation may be adversely affected'," which should be read in conjunction with the information above.


text: Cybersecurity risk management and strategy Our cybersecurity risk management strategy and processes, which are integrated into our overall risk management process, for assessing, identifying and managing material risks from cybersecurity threats are designed based on established frameworks and standards developed by the National Institute of Standards and Technology ("NIST"). Although this does not mean that we currently meet all technical standards, specifications, or requirements, we use this framework, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity defense strategy based on prevention, detection and containment. We employ industry standard measures directly or indirectly related to cybersecurity, such as multifactor authentication, endpoint protection defenses, antivirus protection, encryption standards, restricting access based on business necessity, and remote access monitoring. Our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. The training provides employees with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. We engage third parties to conduct penetration testing and evaluate our adherence to industry-standard frameworks. We assess the security framework employed by our third party service providers including their reports on security, availability and confidentiality to assess and identify material risks from cybersecurity threats associated with our use of third party applications. We have also established liaison programs with the Federal Bureau of Investigation ("FBI") and U.S. Cybersecurity & Infrastructure Security Agency ("CISA") to monitor, identify, and counter advanced persistent threats specific to our company and industry. As part of this program, we have an FBI Special Agent assigned as our Liaison Officer who provides us with periodic cybersecurity threat briefings, and also provides counter-threat support on request.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Cyberattacks impacting our networks or systems may have a material effect on our operations."


text: Governance of cybersecurity risk management Our Board of Directors, acting through the Audit Committee, is responsible for overseeing management's implementation and execution of the risk management process, including our cybersecurity risk management strategy and processes. Our Audit Committee reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management.


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. We have formed a Cyber Security Incident Response Team ("CSIRT") to manage and govern the response to any real or suspected cybersecurity incidents. The CSIRT core team, consisting of the information technology team, classifies detected cybersecurity incidents into one of three categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of cybersecurity incidents is designed to allow rapid prioritization, response and escalation. The CSIRT core team engages with third party experts and cross-functional CSIRT members, as required, to manage the cybersecurity incidents. Cybersecurity incidents that are potentially significant or could result in a material impact are reported to the CSIRT Executive team, consisting of designated executives of the Company. The CSIRT Executive team is responsible for the oversight of the cybersecurity incidents and related critical decisions, performing a materiality assessment, overseeing the public disclosure of material cybersecurity matters, engaging law enforcement agencies, including our local FBI Liaison Officer, correspondence with the media, and communicating with our Audit Committee and Board of Directors, as appropriate.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our board of directors.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: Risk management and Strategy We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have engaged a third-party information technology ("IT") and cybersecurity firm who serves as our dedicated IT and cybersecurity team to help us oversee, implement and manage these processes and controls. This IT and cybersecurity firm is independently audited on an annual basis and has a System and Organization Controls Audit certification.


text: Processes and controls we have implemented with the assistance of our third-part IT and cybersecurity team to assess, identify, manage and protect against material risks from cybersecurity threats include the following: • perform 24/7 security monitoring through an automated detection software managed by our third-party IT and cybersecurity firm; • conduct regular phishing email training for all employees with access to corporate email and other systems to enhance awareness and responsiveness to such possible threats; and • requiring employees, as well as third parties who provide services on our behalf, to treat information and data with care.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to our Incident Response Team. The Incident Response Plan is designed to analyze, contain and remediate any cyber incidents that may circumvent existing safeguards. The Incident Response Plan encompasses a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal and external communication and disclosure protocols. We also maintain data backup procedures in the event of a cybersecurity incident. The Incident Response Plan is evaluated at least annually.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations. See "Risk Factors—Risks Related to Our Business and Properties—Cybersecurity incidents or other technology disruptions could negatively impact our business, our relationships, and our reputation."


text: Cybersecurity Governance As described above, we have engaged a third-party IT and cybersecurity firm to which we have delegated primary responsibility to oversee, implement and manage our processes and controls to assess, identify and manage risks from cybersecurity threats. Management receives monthly reports from the third-party IT and cybersecurity firm regarding cybersecurity incidents and any necessary remedial actions, data security posture and cybersecurity risk management processes and strategies. Management also meets quarterly with the third-party IT and cybersecurity firm to discuss technology and cybersecurity policies and procedures and risks and remediation actions.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the audit committee. As such, our audit committee is responsible for overseeing our overall risk assessment and risk management program as well as our policies and practices related to our information technology systems, information security and cybersecurity risks. Management is responsible for the day-to-day assessment and management of cybersecurity risks. Management works with the third-party IT and cybersecurity firm to identify, assess and manage cybersecurity risks. Our management team includes the chief executive officer and chief financial officer, each of whom has over twenty years of experience in supervising, managing, underwriting, owning, operating and assessing the risks of commercial real estate investments and commercial real estate operating companies. The audit committee reviews at least annually our enterprise risks and related risk management program. In addition, on a quarterly basis, the audit committee receives a report from management on our cybersecurity threat risk management and strategic process covering topics such as cybersecurity incidents and any remedial actions, if needed, data security posture and the results of third-party risk assessments as well as our cybersecurity risk management processes and strategies. Additionally, management would notify the chair of the audit committee following any cybersecurity incident meeting specified security levels, and the audit committee would review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC. Members of our board of directors that are not members of the audit committee are also kept apprised of material risks from cybersecurity threats and our related risk management activities.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: While everyone at the Company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by the Board, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and tenant, employee and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cyberersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.


text: Additionally, we engage third-party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.


text: As of December 31, 2023, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" –"Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" in this Annual Report."


text: With oversight from the Board, the Audit Committee is primarily responsible for assisting the Board in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and protected health information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our information technology department, which is led by our Director of Information Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, and other contractors and suppliers. We also conduct regular employee training on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: BIORA THERAPEUTICS, INC.


text: Our Director of Information Technology, who has over 15 years of experience managing information technology and cybersecurity matters and holds a Master's Degree in computer science with a concentration in cybersecurity, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Our Board of Directors, as a whole and at the committee level, has oversight of the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. Our Audit Committee, which is comprised solely of independent directors, oversees our cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Director of Information Technology as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Identifying, assessing and managing cybersecurity risks is an important component of Conifer's overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the Company and its consolidated subsidiaries.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: The Company and each of its consolidated subsidiaries are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access, and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee training; (vi) disaster recovery testing and (vii) security assessments of third-party service providers.


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past three fiscal years, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's our risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data (including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, "Information Systems and Data").


text: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our Information Systems Representative and Chief Operating Officer identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods designed to accomplish this task including, for example: manual and automated tools, subscriptions to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, and evaluating threats reported to us.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response strategies, systems monitoring, personnel training, cybersecurity insurance, data encryption strategies, network security controls, access controls, physical security controls, and asset management (such as tracking and disposal of Company information systems).


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT Department works with management in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers and professional services firms (including legal counsel). We also use service providers to perform a variety of functions throughout our business, such as application providers, data hosting providers, and CROs. We have a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategies may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, such as reviewing their information security documentation and imposing contractual obligations on them with respect to their information security controls.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could result in adverse consequences including, but not limited to, regulatory investigations or actions, litigation, fines/penalties, disruptions of our business operations, reputational harm, and loss of revenue or profits.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, threats, risks and mitigation. Our Audit Committee also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: Our Information Systems Representative, in coordination with senior management including our Chief Operating Officer works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout our company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the Information Systems Representative and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. The Information Systems Representative has served in various roles in information technology and information security for over 25 years, including serving as the Director of Information Technology of another public company. Our Chief Operating Officer has over 7 years of experience managing information technology, including cybersecurity and risk management.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Terran Orbital Corp


text: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk and is aligned to our business goals and strategy. Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • the use of technologies, products, specialized IT tools and external service providers, where appropriate, to assess, test, understand, manage, mitigate and continually remediate identified risks, or otherwise assist with aspects of our security procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.


text: All cybersecurity risks are logged into our cybersecurity risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident that could have a material negative impact. For more information about these risks, please see "Item 1A. Risk Factors - Cyber-attacks and other security threats and disruptions could have a material adverse effect on our business" in this annual report on Form 10-K.


text: Cybersecurity Governance It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Our information security program is managed by our Senior Vice President and Chief Information Officer ("CIO"), who has over 25 years of IT Risk Management experience. The CIO's cybersecurity team, which includes a team of personnel with more than 30 years of collective information and product security experience, ranging from early-career professionals with cybersecurity degrees to seasoned professionals with multiple cybersecurity-related certifications, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic reports to our management team and our Board, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of related projects, assessments, and emerging threats. Our cybersecurity program is regularly evaluated and reported on to senior management and the Board.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: New York REIT Liquidating LLC


text: This cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: DECEMBER 31, 2023 As we are fully externally advised, we are reliant on our external advisor's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our advisor's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.


text: Our Board of Managers (the "Board") considers cybersecurity risk as part of its risk oversight function. In March 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Chief Financial Officer on our cybersecurity risks. In addition, our Chief Financial Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems. Our Board of Directors will also receive briefings from our Chief Financial Officer on our cybersecurity risk management program as part of our overall business risk updates.


text: Our management, represented by our Chief Financial Officer, oversees the Company's cybersecurity risk management program. Our advisor has elected to engage third-party providers to maintain its network defenses and to manage and assess cybersecurity risk management and strategy for the Company. Our advisor's third-party provider updates our Chief Financial Officer and members of our advisor's management team with any network issues on a monthly basis and makes recommendations for security upgrades as needed. Our Chief Financial Officer takes these recommendations into account in deciding which upgrades to implement. Our Chief Financial Officer will update the Audit Committee quarterly, or more frequently in the case of a significant cybersecurity incident impacting our information systems.


text: Risk Management and Strategy We have developed a cybersecurity program intended to protect the confidentiality, integrity and availability of our systems, data, and products. Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including customized annual training requirements, threat monitoring and detection tools, threat containment methods, risk assessments, and security requirements for our suppliers and other third parties. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable. At least annually, we undertake several assessments to evaluate our cybersecurity controls.

companyName: Acorda Therapeutics, Inc.


text: Management has established an incident response plan designed to assess, identify and manage risks from cybersecurity threats and enable prompt response in the event that a cybersecurity incident is detected. We have a process in place for notification to our leadership response team in the event of a significant cyber incident, and for escalation of these events to our Audit Committee and Board, as appropriate. To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations, or financial condition.


text: The Audit Committee of the Board of Directors oversees our cybersecurity program. It considers cybersecurity risk individually and within our overall risk management framework. We obtain periodic assessments of our information technology systems, including cybersecurity, the results of which assessments are reported to the Audit Committee. During meetings, our Vice President, Information Technology and executive leadership updates the committee on Acorda's cybersecurity posture, potential threats and risk mitigation strategies, and the progress of the Company's cybersecurity initiatives, as appropriate. The Chair of the Audit Committee and management provide regular briefings on such matters to the full Board of Directors, as appropriate.


text: Our Vice President, Information Technology is primarily responsible for leading our cybersecurity program through our information technology team. Our Vice President, Information Technology has over 20 years of experience in information technology, and regularly reports on cybersecurity matters to our Audit Committee. Our Vice President, Information Technology reports directly to our Chief Financial Officer, who is a member of our executive leadership team and reports directly to our Chief Executive Officer. As of December 31, 2023, our Information Technology team consisted of team members and contractors, many of whom have advanced degrees and cybersecurity-related industry certifications. Under the direction of our Vice President, Information Technology, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to continually enhance our cybersecurity program in response to such developments.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our SafetySmart platform ("Information Systems and Data").

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Our information security and engineering functions, led by our Vice President of Operational Engineering, help identify, assess and manage the Company's cybersecurity threats and risks. These teams identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our industry's risk profile using various methods including, for example manual and automated tools (including firewalls and endpoint protection); subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our environment; evaluating threats reported to us and coordinating with law enforcement concerning certain threats; conducting threat assessments of both internal and external threats; conducting vulnerability assessments to identify vulnerabilities; working with third-parties to conduct testing and tabletop exercises; and using external threat intelligence feeds.


text: Depending on the environment and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response and detection policy and processes; vulnerability management processes; a secure software development lifecycle policy and change management procedures; business continuity plans; penetration tests; encrypting certain data; using network security controls; segregating and maintaining access controls over certain data; asset management and tracking; training our employees; and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; penetration testing firms; darkweb monitoring services; and managed detection and response providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and network and cellular communications providers. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including for example, conducting risk assessment of certain vendors, providing our vendors with a security questionnaire or reviewing their SOC report, reviewing the vendor's written information security program in certain circumstances, conducting audits of our vendors as may be needed, and requiring certain technical controls of our vendors through contractual obligations.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risks titled "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation or mass arbitration demands; fines and penalties; disruptions of our business operations; reputation harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Operational Engineering, Dave Halliday. Mr. Halliday has over thirty years of experience in information technology and information security management and oversees our operational engineering component, which includes our information security function, IT, networking, cloud operations, and development operations teams.


text: Mr. Halliday is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Financial Officer, and the Vice President of Operational Engineering. Those members of management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Chief Financial Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We are a blank check company with no business operations. Since the date of the IPO, our sole business activity has been identifying and evaluating suitable Business Combination candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of any risks from cybersecurity threats. We have not encountered any cybersecurity incidents since inception.

companyName: Generation Asia I Acquisition Ltd


text: Our Cybersecurity Approach and Strategy Our cybersecurity approach includes consideration of information security controls in aspects of the business where unauthorized occurrences could adversely affect the confidentiality, integrity, or availability of our information systems as part of our overall risk management strategy, looking to the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guide in how we identify, assess, and mitigate material cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cybersecurity governance, prevention, detection, and remediation activities within our Company's cybersecurity environment.

companyName: Leafly Holdings, Inc. /DE


text: We have engaged external cybersecurity professionals to help design and manage our security program. These experts conduct annual penetration testing and incident response tabletop exercises, make recommendations on how to continuously improve our cybersecurity program, and assist us in implementing their recommendations into our existing processes.


text: Accordingly, we have implemented processes for overseeing, detecting and identifying material risks from cybersecurity vulnerabilities and threats, and technical, process, and people related security controls designed to mitigate material cybersecurity risks. We also maintain an Incident Response Plan, which defines the procedures for evaluating, and reporting cybersecurity incidents to executive leadership. The Incident Response Plan also creates a framework and delegates tasks to appropriate personnel for responding to a cybersecurity incident based on the severity of an incident. These processes are integrated into our overall risk management strategy.


text: Our ongoing cyber risk management efforts include penetration testing to assess and manage cybersecurity risks and monthly reviews of our risk register, which are updated on an ongoing basis. From time-to-time, we also provide enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.


text: We have experienced security incidents in the past, which we believe were immaterial and were not reportable under applicable state law or our other obligations; however, there can be no assurance that our determinations were correct. We do not believe there are material risks from cybersecurity threats, including as a result of previous incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Oversight of Third-Party Service Providers We manage cybersecurity risks through our use of third-party service providers by integrating our mitigation strategies throughout various functional areas within the Company, including but not limited to the Company's business segments and information technology, engineering, infrastructure, and legal departments. These strategies include, as applicable, conducting technical assessments at the outset of any third-party service provider engagement, limiting the disclosure or transfer of information to an as-needed basis by way of technical infrastructure, and contractually requiring third parties to maintain security controls and protect our information and maintain established notification protocols in the event of any known material data breach using industry best practices.


text: Our Senior Vice President of Product, who has extensive cybersecurity knowledge from over 20 years of experience in leadership roles at technology companies ranging in maturity from various startups to Sony, a large billion dollar corporation, leads the team responsible for overseeing, managing, and assessing our material cybersecurity risks, and works in close coordination with other members of leadership, infrastructure, and information technology, and our external professional providers to maintain cybersecurity risk management and data protection.


text: Our Board oversees the risk management activities designed and implemented by our management. Our Board executes its oversight responsibility both directly and through its committees, and has delegated the responsibility of providing oversight of cybersecurity risks to its Audit Committee, including oversight over the steps management takes to monitor and control such exposures. Our Senior Vice President of Product and external cybersecurity professionals are responsible for overseeing, managing and assessing material cybersecurity risks, and periodically report to the Audit Committee on the ongoing development, status and health of our cybersecurity program and material cybersecurity risks or incidents, if any.


text: The Board recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: STRYVE FOODS, INC.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: No risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Stryve's business, financial condition, results of operations and relationships with customers. We describe whether and how risks related to cybersecurity threats are reasonably likely to materially affect us, including our business, financial condition, results of operations and relationships with customers, in Item 1A of this Annual Report on Form 10-K.


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Financial Officer. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management is responsible for developing cybersecurity programs. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees, and prior work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Risk Management and Strategy The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program is designed to allow us to identify, assess, and manage cybersecurity risks. Our Chief Technology Officer, with the support of our IT Manager, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Technology Officer has 30+ years of experience leading and managing consumer facing services at scale. He has a Bachelor of Science in Computer Science and has led and managed both engineering and Enterprise IT teams across large scale organizations focused on delivering secure and performant consumer products. Our Chief Technology Officer also works closely with other management positions to ensure that the Company understands its cybersecurity risk management responsibilities.

companyName: Interactive Strength, Inc.

ticker: TRNR


text: To operate our business, we utilize third-party service providers to perform various functions, such as outsourced business-critical functions, professional services, SaaS platforms, cloud-based infrastructure, content delivery to third parties, and other functions. We engage reliable, reputable service providers that maintain cybersecurity programs and we conduct upfront cybersecurity reviews as part of our onboarding process for partners.


text: The Company reports on its information security program to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reports matters to the Board of Directors as needed. Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats to and security incidents relating to our information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and processes and controls supporting requirements with the General Data Protection Regulation (GDPR). We have an annual assessment performed by a third-party specialist of the our cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a Risk Mitigation Plan to mitigate such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Banzai International, Inc.

ticker: BNZI


text: In addition, we maintain policies over areas such as information security, incident management, business continuity, IT change and configuration management, acceptable use and access on/offboarding to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in our IT environment.


text: Our cybersecurity partners, including consultants, and other third-party service providers are a key part of our cybersecurity risk management strategy and infrastructure. These partners provide services including, but not limited to configuration management, penetration testing, network protection and monitoring, remote monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.


text: Our management team, in conjunction with the Chief Technology Officer and cybersecurity service providers are responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners. Management relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged for strategic cyber risk management, advisory and decision making.


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes vendor due diligence prior to onboarding, a review of System and Organization Control (SOC) reports on an annual basis, regular review of vendor contracts, and compliance with service level agreements (SLAs).


text: Our Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practical through changes or updates to our internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as the cybersecurity risk assessment process and developed an incident response plan. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Seritage Growth Properties

ticker: SRG


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of this process, we have elected to engage third-party managed service providers to maintain our network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our hosted services, all of the computer and computer-related hardware and software we use, and for managing our backup processes. Our primary managed service provider supplies management with weekly updates and activity reports related to network alerts, connectivity issues, and help desk tickets.


text: Our management team has taken additional steps to implement our cybersecurity risk management program. For example, we have implemented periodic management reviews of our controls related to provisioning of user access to certain third-party hosted applications that we use in connection with the business and risks posed by certain critical vendors; this includes reviewing System and Organizational Control audit reports of such vendors. We maintain cybersecurity insurance coverage intended to mitigate our financial exposure to certain cybersecurity threats, and we consult with external advisors regarding opportunities and enhancements to strengthen our cybersecurity processes and practices.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function. In February 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Interim Chief Financial Officer or our Chief Legal Officer on our cybersecurity risks. In addition, our Interim Chief Financial Officer or our Chief Legal Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our information systems. Our entire Board will also receive briefings from our Interim Chief Financial Officer or Chief Legal Officer on our cybersecurity risk management program as part of our overall business risk updates.


text: Our management, represented by our Interim Chief Financial Officer, John Garilli, oversees the Company's cybersecurity risk management program. We have elected to engage third-party providers to maintain our network defenses and to manage and assess cybersecurity risk management and strategy for the Company. Our third-party providers update Mr. Garilli and other members of our executive management team with any network issues on a weekly basis and make recommendations for security upgrades as needed. The Interim Chief Financial Officer or the Chief Legal Officer will update the Audit Committee quarterly, or more frequently in the case of a significant cybersecurity incident impacting our information systems.


text: Risk Management and Strategy Our company is guided by a comprehensive cybersecurity framework to assess, identify, and manage material risks from cybersecurity threats. This framework is integrated into our overall quality and risk management system and is designed to protect our systems, data, and operations from cybersecurity threats. The framework includes policies to protect confidential information, guide periodic risk assessments, oversee and identify risks from cybersecurity threats associated with our use of third-party services providers, including through the use of a third-party risk management policy that accounts for such risks, and an incident response plan designed to detect, respond to, and recover from cyber incidents. Under this framework we may engage consultants and other third parties to assist in conducting cybersecurity risk assessments, implementing mitigation strategies, and testing the effectiveness of our cybersecurity controls.

companyName: VACCINEX, INC.

ticker: VCNX


text: There can be no guarantee that our policies and procedures will ultimately prove to be effective in every instance, especially considering evolving risk. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that these risks have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure related to cybersecurity risks, and our executive officers are responsible for the day-to-day assessment and management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function through the Audit Committee.


text: Our Chief Operating Officer and Systems Administrator are primary responsible for assessing and managing the cybersecurity risks we face under our policies and procedures, including those described in "Risk Management and Strategy" above. Our Chief Operating Officer is primarily responsible for reporting any material cybersecurity related incidents to our Audit Committee.


text: Risk Management, Governance and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.

companyName: OOMA INC

ticker: OOMA


text: Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation. We have tools and protocols in place designed to prevent, detect and escalate security incidents within the Company.