text: The Board Enterprise Risk Management ("ERM") Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls. The Chief Information Officer ("CIO") manages the IT Department and reports to the Board Risk Committee and Chief Risk Officer ("CRO") on these matters. The CIO also supervises the Information Security Officer ("ISO") who is responsible for implementing and maintaining the Company's Information Security Program. The Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. Additional cybersecurity training to the ERM Committee is provided and overseen by the CRO and CIO. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company's ERM Working Group, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company. The ERM Working Group is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank's corporate strategies, and ensuring compliance with applicable laws and regulations. The Bank's IT Steering Committee in conjunction with the Bank's PMO oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.


text: The ERM Working Group provides executive management oversight, from a risk perspective, of information systems security. As referenced above, the CIO provides information security updates to the ERM Working Group at each meeting. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the ERM Working Group. Cybersecurity metrics are reported to both management level committees and the ERM Committee and ERM Working Group on a quarterly basis.

companyName: NB Bancorp, Inc.

ticker: NBBK

secItem: Item 1C


text: The Board of Directors recognizes the importance of the FFIEC for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: We continually monitor and evaluate the evolving cybersecurity landscape and the potential impact of cybersecurity incidents on our business. We may incur additional costs to enhance our cybersecurity processes and controls, to comply with new or changing laws, regulations, or contractual obligations, or to respond to or recover from cybersecurity incidents. We may also experience reputational harm or loss of customer confidence or trust as a result of cybersecurity incidents. Any of these factors could have a material adverse effect on our business, financial condition, results of operations, and reputation.


text: Despite our efforts to enhance our cybersecurity posture, we cannot guarantee that our processes and controls will be sufficient to prevent or mitigate all cybersecurity risks and threats that we face. We may experience cybersecurity incidents that result in unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; disruption or degradation of our operations; loss of customers or business opportunities; regulatory investigations or enforcement actions; litigation or liability; reputational damage; or increased costs.


text: Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with Enterprise Risk Management, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT Steering Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. Ensuring that changes to security configurations are documented, approved, and tested. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. Investing in additional technologies or resources to aid in the evaluation, identification and mitigation of risks. Conducting subsequent penetration testing and vulnerability assessments, as warranted.


text: Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis, which may identify additional risks or require additional costs to remediate.


text: Service Providers. The Company relies, in part, on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Risk Management Program, which is implemented through a Vendor Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Vendor Relationships: Risk Management. The Vendor Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the CIO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CIO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CISO is responsible for implementing and maintaining the IRP, which includes:


text: Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.


text: Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.


text: Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures. Report up to the Executive Incident Response Committee, as needed.


text: The Bank, as part of its risk management process, has implemented an information security program that encompasses the Bank's cybersecurity efforts. The Bank's goals of confidentiality, availability and integrity of its information are key to this process and program. The Bank's goals of protecting confidential information and safeguarding our digital assets are foundational objectives of the program.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors annually approve this information security program and regularly receive a report from the Bank's Information Security Officer that outlines the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer updates the Boards of Directors through supplementary reports on issues related to Cybersecurity readiness.


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer. Together with the Bank's Information Technology Committee, comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security Officer of the Bank works to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors receives training annually.


text: The Bank engages trusted third parties to audit and examine its processes, review the security of its network infrastructure, and assist the Bank in designing and implementing robust cybersecurity systems. These trusted third parties help the Bank improve and test its cybersecurity readiness. The Bank engages third party vendors to monitor and test its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by specialized vendors that assist the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.


text: Although the Company and Bank have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected their business strategy, results of operations or financial condition, there can be no guarantee that the Company or Bank will not experience such an incident in the future.


text: As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation –Cybersecurity" included in Part I. Item 1 – Business of this report.


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, violation of privacy or security laws and other litigation and legal risk; and reputational risks. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future.

companyName: MetaVia Inc.

ticker: MTVA


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards. We work with a third-party provider to monitor for threats and potential cybersecurity breaches.


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or reported by our third-party monitoring service that may affect our information services, and have processes to assess those issues for potential cybersecurity impact or risk. We impose security requirements upon our suppliers and CROs, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the audit committee, which reviews our cybersecurity program with management and reports to the Board.


text: The audit committee is central to the Board' oversight of cybersecurity risks and bears the primary responsibility for this domain. The audit committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Our chief executive officer, chief financial officer and corporate controller have operational experience in assessing and managing cybersecurity risk. Our chief executive officer plays a pivotal role in informing the audit committee on cybersecurity risks. They provide comprehensive briefings to the audit committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the audit committee and chief executive officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the board's oversight is proactive and responsive. The audit committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of NeuroBo.


text: Our chief financial officer is informed by our third-party monitoring service of any cybersecurity incidents, who will then escalate the incident to our chief executive officer, if necessary. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management and Strategy Managing cybersecurity risks is an important component of our approach to enterprise risk management. As part of our overall risk management system, we have established certain procedures to assess, identify, mitigate and respond to risks from cybersecurity threats. We have regular programs to evaluate cybersecurity threats and to assess our systems, procedures and processes in order to identify areas of potential vulnerability and to improve our protection against evolving cybersecurity threats. We use a number of different methodologies in our regular assessment of cybersecurity risks with respect to our information systems, including vulnerability testing, security enhancement and evaluation of external threats, including in connection with potential data breach, ransomware and other forms of unauthorized access.

companyName: RH

ticker: RH


text: As part of our overall cybersecurity protection program, we have created a cross-functional cybersecurity team consisting of senior members of information technology, legal, accounting, internal audit and compliance teams (the "Incident Response Team") that contributes to various aspects of our approach to managing cybersecurity risks. Our senior information technology leaders who are members of the Incident Response Team have experience and domain expertise in cybersecurity, including defining and implementing security policies and tools, understanding and evaluating relevant threats to our technology infrastructure as well as developing incident response protocols and security operations workflows. We also incorporate third-party expertise in various aspects of our cybersecurity program, including in the assessment and testing of weaknesses as well as the adoption of software and other solutions to mitigate risks and identify and respond to threats. Our Incident Response Team is involved in all aspects of our program to address cybersecurity matters, including with respect to the design and management of internal controls and procedures governing these matters.


text: Our information technology team oversees the day-to-day management of our cybersecurity program with regular reporting to representatives of our Incident Response Team. Our information technology team has overall responsibility for our cybersecurity risk management program and procedures and reports regularly to the Audit Committee of our Board of Directors on cybersecurity matters. From a governance perspective, (i) we have an executive response team consisting of various senior executives, including our Chief Financial Officer, as well as members of our Incident Response Team (the "Executive Response Team") that oversees the recommendations, actions and responses of the Incident Response Team in connection with specific cybersecurity incidents, and (ii) the Audit Committee as well as our Chief Executive Officer are provided with updates from the Executive Response Team and the Incident Response Team regarding incidents as well as the policies, standards, processes and practices that we implement to address risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity matters that address a wide range of topics, including recent developments, evolving standards, vulnerability assessments and third-party reviews.


text: Incident Response We have a written information security incident response plan (the "Incident Response Plan") that we use to assist in our response to cybersecurity incidents. The Incident Response Plan provides a framework and process for our Incident Response Team. While our Incident Response Team identifies our initial response to potential or actual cybersecurity incidents, the Executive Response Team oversees the actions and recommendations of the Incident Response Team in connection with specific cybersecurity events. In addition, we have various processes to escalate matters based upon the threat level severity. The Incident Response Team and Executive Response Team (i) make ongoing assessments of the severity of incidents, (ii) escalate these matters based upon the severity of the threat level, (iii) depending on the level of severity of an incident, also involve our Chief Executive Officer or Audit Committee and Board of Directors in assessing specific cybersecurity incidents, (iv) determine the appropriate level of response to specific incidents taking into account the nature of the incident, and (v) take overall responsibility for leading and coordinating response efforts, involving additional response team participants and retaining third-party assistance, including legal counsel and other third-party cybersecurity experts, and assessing materiality of an incident.


text: Threat Mitigation While we engage in numerous efforts to protect ourselves from cybersecurity risks, we do periodically experience cybersecurity incidents. To date we have not experienced any cybersecurity threat or incident that has materially affected our business, results of operations or financial condition. We have also not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Although we have adopted various processes and preventative measures with the objective of preventing breaches and minimizing the risks from cybersecurity matters, given the nature of cybersecurity threats that are constantly evolving over time, there is no guarantee that we, including our business strategy, results of operations or financial condition, will not be adversely affected by such threats or that our preventative measures and processes will be effective. Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events.


text: For further discussion of our risks related to cybersecurity, refer to Item 1A—Risk Factors—Material damage to, or interruptions in, information systems as a result of external factors, staffing shortages, cybersecurity breaches or cyber fraud, or difficulties in updating our existing software or developing or implementing new software could have a material adverse effect on our business or results of operations, and we may be exposed to risks and costs associated with protecting the integrity and security of our customers' information.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development, to communicate internally and externally, to operate our accounting and record-keeping functions, to store and access data including sensitive patient data and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Solana Co

ticker: HSDT


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or patients, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.


text: In coordination with third-party consultants, we have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct annual reviews and tests of our information security program to evaluate its effectiveness and improve our security measures and planning.


text: To operate our business, we utilize certain third-party service providers and vendors to support a variety of functions. We seek to engage reliable, reputable service providers and vendors that maintain cybersecurity programs, and we implement a vetting process to ensure that all third-party service providers and venders comply with our cybersecurity program requirements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. Oversight of such cybersecurity risks is executed directly by the Board of Directors. The Board receives reports and engages in regular discussions with management regarding the Company's significant risk exposures resulting from material cybersecurity threats and the measures implemented to monitor and reasonably manage these risks.


text: Our Director of Information Technology leads our information security organization and reports to our Chief Executive Officer and Chief Financial Officer on matters related to cybersecurity who then in turn report to the Board of Directors any material information regarding such cybersecurity matters. Our Director of Information Technology has over 30 years of IT experience and has developed a focus of experience in the healthcare industry.


text: We incorporate assessment of our cybersecurity risk management and strategy into our overall management of enterprise risk. The Company evaluates cybersecurity threat risk areas across its business including, but not limited to, operational risk, fraud, harm to employees or third parties, patient safety and violation of privacy or security-related laws or regulations. The Company has a Compliance Committee that is responsible for overseeing the enterprise risk management process. As part of our efforts to mitigate cybersecurity threats, we have implemented cybersecurity processes, technologies, and controls designed to effectively identify and manage potential material cybersecurity threats.

companyName: AGILE THERAPEUTICS INC


text: Assessment, Identification and Risk Management of Cybersecurity Threats We employ a range of tools and services, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessment and penetration testing, to update our ongoing risk management and strategy. Furthermore, we have a cybersecurity assessment process that is conducted regularly with our current information technology (IT) services provider. -We proactively engage with our IT services provider as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We also have used an additional third-party services provider to perform internal and external penetration testing and social engineering employee challenge testing.


text: Governance and Oversight of Cybersecurity Threats Our information security program is managed by our Chief Corporate Planning and Supply Chain Officer (CCPO), who has more than ten years' experience managing IT services for Agile and possesses the required subject matter expertise, skills, and experience expected of an individual assigned to these duties. Our information security team, which includes the CCPO as well as additional professionals from our IT services provider, is responsible for leading enterprise-wide cybersecurity threat strategy, policy, standards, and processes. Our CCPO provides regular updates to our Chief Executive Officer and other members of management regarding cybersecurity threats and participates in the quarterly Compliance Committee meetings.


text: The Audit Committee is responsible for oversight of the Company's cybersecurity risk exposure. The CCPO provides reports to the Audit Committee and Board at least annually, which include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: Incident Response and Reporting The Company has a cybersecurity policy that governs the corporate response to and communication of security incidents affecting the Company's information technology system and stresses the need for fast response times and continuous improvement in security measures. The policy requires immediate reporting of any observed security incident to the CCPO, the Company's third-party IT services provider, Chief Financial Officer, and Chief Executive Officer. The CCPO, working with our IT services provider and any other third parties required, is responsible for taking steps to minimize loss and destruction, identify and correct any weakness that was exploited, restoring IT services and continuing to communicate to senior management and the Board on the event. The CCPO is authorized to employ any third-party service providers as necessary. The policy also requires the conduct of post-incident analyses, reporting on the incident, identification of lessons learned and a close-out report.


text: Oversight of Third-Party Providers Prior to doing business with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity preparedness. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.


text: Impact of Cybersecurity Threats on our Business Although risks from cybersecurity threats did not, to our knowledge, materially affect our business strategy, results of operations, or financial condition for the fiscal year ended December 31, 2023, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1, Business, in this Annual Report for a discussion of notification obligations and potential liability around data security incidents, including cyberattacks.


text: Cybersecurity Risk Management and Strategy We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats. We also engage with third parties, including consultants, to enhance our security processes.

companyName: Fortress Biotech, Inc.

ticker: FBIO


text: We have previously engaged and currently engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.


text: We review the processes of our third party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity".


text: Cybersecurity Governance While our board of directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our management team is informed of and monitors the prevention, detection, and mitigation of cybersecurity threats and incidents.


text: Our information security program is managed by a dedicated Chief Information Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Chief Information Officer provides periodic reports to our Board of Directors, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: NorthEast Community Bancorp, Inc./MD/

ticker: NECB


text: Nutex manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: Nutex Health Inc.

ticker: NUTX


text: Our cybersecurity program is managed by our Information Technology Manager and Chief Operating Officer. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the Information Technology Manager and Chief Operating Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Information Technology Manager and Chief Operating Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


text: We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We will perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Information Technology Manager and Chief Operating Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.


text: We believe our Information Technology Manager and Chief Operating Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Information Technology Manager has 17 years of information technology experience across multiple industries before joining Nutex Health.


text: As of December 31, 2023, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes, which are effected principally through an outside information technology management/cybersecurity consultant and a computer security firm that we have engaged, include procedural and technical safeguards, response plans, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. Our computer security firm serves as our managed security services provider, and its services include managed detection and response, incident management, managed security awareness and a quarterly risk assessment. Our information technology management/cybersecurity consultant has responsibility for managing detection and incident response in consultation with out our managed security services provider. We considered the internal risk oversight programs of our information technology management/cybersecurity consultant and our managed security services provider before engaging them. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: KALA BIO, Inc.

ticker: KALA


text: While we have not experienced any material losses relating to cyber-attacks, in 2019 we were the subject of a successful phishing attempt. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors, or the Audit Committee, provides direct oversight over cybersecurity risk. Our Audit Committee and Board of Directors receive periodic updates from our Chief Legal Officer and Chief Compliance Officer, together with our outside information technology management/cybersecurity consultant, and the Audit Committee and Board of Directors is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Chief Legal Officer and Chief Compliance Officer is responsible for the management oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us to address cybersecurity risks. Our Chief Legal Officer and Chief Compliance Officer has many years of experience overseeing company-wide legal and compliance risks, including at multiple publicly-traded companies. Our Chief Legal Officer and Chief Compliance Officer is supported by our outside information technology management/cybersecurity consultant and our managed security services provider.


text: We have also established a cross-functional Cybersecurity Committee led by our Chief Legal Officer and Chief Compliance Officer serving as the chair and consisting of senior leaders within our organization. The Cybersecurity Committee, with assistance from our outside information technology management/cybersecurity consultant, oversees our cybersecurity policy, which includes risk assessment, investments in cybersecurity technologies, cybersecurity insurance and review of relevant information technology policies.


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with periodic cybersecurity training. This training program covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all cybersecurity incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, ("NIST"), and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Molecular Templates, Inc.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including deployment of threat monitoring and mitigation solutions, regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats;


text: run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies;


text: leverage internal incident response plans and procedures to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation, including coordination with public relations and internal and external communications teams.


text: As part of the above processes, we regularly engage with third parties to review our cybersecurity program and help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. We generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business Operations," which disclosures are incorporated by reference herein.


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity scorecard / dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our head of Information Technology. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our head of Information Technology. Such individuals have collectively over 6 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. As a financial services company, cybersecurity threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This strategy includes employee training, innovative technologies, and policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response.


text: The Company leverages a variety of industry frameworks and regulatory guidance to develop and maintain its information systems and cybersecurity program, including but not limited to Interagency Guidelines Establishing Information Security Standards, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook (with particular emphasis on the FFIEC's Information Security and Business Continuity Management Handbooks), FFIEC Cybersecurity Assessment Tool, Gramm-Leach-Bliley Act ("GLBA") 501(b), and the Center for Internet Security ("CIS") Critical Controls Framework. In addition, the program leverages certain, third-party benchmarking, audits, and third-party threat intelligence sources to facilitate and enhance the effectiveness of the program.


text: Core activities supporting the Company's strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Company and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups stored at off-site locations and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations, and these third-party vendors continue to be a source of operational and informational risk. Accordingly, the Company has implemented a third-party risk management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.


text: As indicated above, supporting the operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. As such, the Company engages third-party consultants and independent auditors to conduct penetration tests, cybersecurity risk assessments, external audits, and program development and enhancement where applicable.


text: Cybersecurity Governance Management Oversight. The Chief Technology Officer oversees the Information Technology Department which, among other things, is responsible for identifying, assessing and managing material risks from cybersecurity threats and has more than thirty years of experience in the information technology field. The Chief Technology Officer is a member of various management committees and participates in Board of Directors' meetings as well as Audit Committee meetings where the overall status of information technology and security is discussed including the related policies and risk assessments. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for policy and program enhancements.


text: Further, the Chief Technology Officer is a member of the Compliance Committee chaired by the Chief Compliance Officer, which consists of members of senior and executive management, as is it charged with maintaining Bank-wide compliance with relevant statutes, regulations, and interpretations as well as consumer protection.


text: Board Oversight. The Board of Directors is responsible for reviewing the overall policies and practices for risk management, including delegation of oversight for particular areas of risk to the appropriate subcommittees. Collectively, the Board of Directors and its subcommittees are responsible for discussing with management major financial risk exposures as well as significant operational, compliance, reputational, strategic and cybersecurity risks, and the steps management has taken to monitor and manage such exposures to be within the Company's risk tolerance.


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. Third parties are also incorporated into our approach to cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, cybersecurity maturity assessments or consulting on best practices to address current and new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: Precipio, Inc.

ticker: PRPO


text: Risk management and strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our IT Manager and Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Operating Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Operating Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Risk management and strategy Our accounting and financial reporting platforms and related systems, and those that we, or our third-party service providers, offer to our tenants are necessary for the operation of our business. We use these platforms and systems, among others, to manage our tenant relationships, for accounting and financial reporting, and for other recordkeeping purposes. Our business operations and financial reporting rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Trinity Place Holdings Inc.

ticker: TPHS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on our management and third-party service providers to manage any perceived cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, internal controls within our accounting and financial reporting functions, network security controls, access controls, physical security, systems monitoring, and employee training.


text: We work with third parties from time to time that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms and information technology consulting and support firms. To operate our business, we utilize certain third-party service providers to perform a significant portion of our critical functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. To address risks associated with third-party service providers, we will review and assess the cybersecurity controls of our third-party service providers and make changes to our business processes to manage these risks. This approach is designed to mitigate risks related to data breach or other security incidents originating from third-party service providers.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Steven Kahn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Kahn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2015. Mr. Kahn currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Kahn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any serious cybersecurity incidents to our Board.


text: Cybersecurity Risk Management and Strategy We, through our third -party service provider that manages our information technology systems and networks, have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: FENNEC PHARMACEUTICALS INC.

ticker: FENC


text: Our security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, ensure maintenance of backup and protective systems, and engage with a Managed Service Provider who has a team of security personnel managing our efforts and initiatives. We review System and Organization Controls 1 (SOC 1 Type II) certifications where relevant from key third party partners and other service providers with access to information assets at least annually.


text: We maintain Information Systems Incident Management Standards that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our internal controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment designated team members are responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and Maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any cybersecurity threats that have materially affected the Company.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and oversees our cybersecurity and other information technology risks and management's implementation of our cybersecurity risk management program.


text: Our Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board and the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program and supervises our retained provider of IT services and external cybersecurity consultants. Our Chief Financial Officer has experience supervising and managing company security and privacy departments.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess, and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company engages a third-party provider to conduct periodic maturity assessments. The Company stores data in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: Our cybersecurity program is managed by the Annovis Incident Management Committee (the "AIMC"). The AIMC serves as the core team responsible for managing the enterprise-wide cybersecurity policy, maintenance and compliance across all platforms. The AIMC is responsible for the detection and initial assessment of potential cybersecurity threats and incidents. The AIMC classifies detected cyber incidents to allow prioritization, response and escalation. Incidents are documented for internal reporting processes and regularly shared with senior management.


text: Our third-party IT service provider is a key part of our cybersecurity program. We partner with a cybersecurity company and leverage their technology and expertise to better protect the Company. From time to time, we engage this vendor to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. We intend to continue to work to formalize our cybersecurity program, including developing processes for third-party service provider cyber-risk oversight and management.


text: In the event of a potential cybersecurity incident, the AIMC will conduct an assessment to determine the nature and scope of the incident and manages the incident in accordance with our incident response plan until the incident is contained and resolved. The AIMC will document findings and make them available to the Disclosure Committee, which includes cross functional senior management representation from, legal, finance, investor relations and business segments. The Disclosure Committee, in conjunction with third-party experts, including outside legal counsel, is responsible for assessing the materiality of any cybersecurity incident and coordinating external communications and disclosures, including with the Securities and Exchange Commission.


text: As of December 31, 2023, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition, although we may be materially affected in the future by such risks or future material incidents. See "Risk Factors—Risks Related to Our Business Operations—Disruption, failure or cyber security breaches affecting or targeting computers and infrastructure used by us or our business partners may adversely impact our business and operations" for additional information regarding cybersecurity risks.


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for the Annovis management and Board of Directors. We continue to invest in cybersecurity and enhance our internal controls and processes, which are designed to help protect our systems and the information they contain.


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board has delegated to the Audit Committee the responsibility to oversee the integrity of the Company's information technology and cybersecurity risks and to assess the risks and incidents relating to cybersecurity threats. While our Board and Audit Committee oversee cybersecurity risk, management, through the AIMC, is responsible for the implementation and management of cybersecurity risk management systems and processes and for the communication of incidents to senior management and the Audit Committee.


text: The AIMC meets with the Audit Committee on a quarterly basis and meets with the BOD at least annually. Additionally, the Audit Committee regularly meets with members of the Company's internal audit function to discuss risk management activities, compliance, best practices, and other related matters.


text: Risk Management and Strategy We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion. Our internal auditors perform audit engagements to assess our strategies, policies, procedures, and controls to reduce the risk of a cybersecurity incident.

companyName: BATTALION OIL CORP

ticker: BATL


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. With the assistance and advice of our expert consultants, responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our Director of Information Technology, who reports to our Chief Executive Officer.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into our compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee of the Board having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cybersecurity, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.


text: In addition, the Audit Committee, with the assistance and advice of Company management and third-party consultants, oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The Audit Committee receives quarterly reports from Company management, which includes cybersecurity risk factors.


text: The Board routinely receives information and updates from Company management and the Audit Committee with respect to the effectiveness of the Company's information systems' security framework, which may include cybersecurity assessments, risk management, and mitigation measures. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts.


text: We have not identified an indication of a substantive cybersecurity incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A Risk Factors above.


text: Risk management and strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Compliance Officer to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training sessions.


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures and monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Financial Officer and Chief Compliance Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Financial Officer and Chief Compliance Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats and plans and strategies to address threats and incidents.


text: Our Chief Compliance Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: The audit committee oversees risks related to cybersecurity, including the security of corporate information and the steps management is taking to monitor and control these risks. Management regularly briefs the audit committee on our cybersecurity risk profile, potential threats, and continuous improvement initiatives. Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, enhancing our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Risk Management and Strategy We engage a third-party Managed Service Provider (MSP) to implement technology infrastructure and oversee its tactical operations. Our MSP employs multiple people with experience in technical leadership, system architecture, network infrastructure and cybersecurity. We believe using an MSP provides economies of scale for a smaller-sized company such as ours, by allowing us access to a broad range of experience and tool sets that would otherwise be difficult to acquire in-house. Our MSP uses specialized third-party services and tool sets for identifying, protecting against, and detecting cyber incidents. Through these services and tools, our detection capabilities include, but are not limited to, near real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide near real-time alerts, log aggregation, and threat intelligence feeds.


text: In addition, we engage cybersecurity consultants, unaffiliated with our MSP, to advise management, assess our technology tools and review our cybersecurity practices. Our consultants utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess our cybersecurity risk and governance practices. The NIST Cybersecurity Framework enables organizations, regardless of size, to apply principles and best practices of risk management to improve security and resilience.


text: Material Impact of Cybersecurity Threats While to date we are not aware of any material information security breaches and have not incurred significant operating expenses related to information security breaches, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the risks related to our business section for more information. Our incident response practices require incident assessments to be conducted in concert with our CEO, CFO and MSP. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: TREVENA INC


text: We have leveraged the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. We provide ongoing training to our employees to identify and understand the risks from cybersecurity threats, Further, we follow a formal, documented process to assess the data protection practices of certain third-party vendors.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;


text: an outsourced security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training for our employees, incident response personnel, and senior management. This includes mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), our outsourced security team has a written incident response plan outlining how to address cybersecurity events that occur. We have assigned a team comprised of finance and technology personnel to review the plan annually to serve as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. In addition to the cybersecurity incident response plan, our outsourced team conducts tabletop exercises to enhance our incident response preparedness. They also have processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. Such processes include conducting due diligence and risk assessment of our current and potential vendors that examine such vendor's cybersecurity protocols and adherence to applicable regulations.


text: We also maintain business continuity and disaster recovery plans to prepare for and respond to the potential for any disruption in the technology we rely on. Additionally, we maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to Cybersecurity, Data Privacy and IT Systems," in Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our Senior Vice President, Chief Business Officer and Head of Commercial Operations is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Vice President, Chief Business Officer and Head of Commercial Operations has nearly 10 years of experience overseeing information technology activities.


text: Our audit committee has oversight over cybersecurity risks. Our management provides periodic presentations to the audit committee on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The audit committee provides updates regarding our cybersecurity program to the board of directors when material.


text: Cybersecurity Risk Management and Strategy In the normal course of business, we may collect and store personal information, customer information, and certain sensitive company information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding trial participants in connection with clinical trials, sensitive third-party information, and employee information. To protect this information, our existing cybersecurity policies require monitoring and detection programs, network security measures, and encryption of critical data. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We have established our disaster recovery plan, and we protect against business interruption by backing up our major systems. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Zomedica Corp.

ticker: ZOMDF


text: Our cybersecurity program is led by our Vice President of Technology Innovation and includes a team of information technology professionals. The program is further strengthened through support of our General Counsel. These teams work closely together to support and bolster our cybersecurity program, which incorporates industry-standard frameworks, policies, and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity team informs our Audit Committee on information security and cybersecurity matters as needed.