text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats. However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. In the event of a cybersecurity incident impacting us, the management team will report to our board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Translational Development Acquisition Corp.

ticker: TDAC


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Roman DBDR Acquisition Corp. II

ticker: DRDB

secItem: Item 1C


text: We operate in the pharmaceutical industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including: intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect customers', employees', and vendors' information and prevent data loss and other security breaches, including a cybersecurity risk assessment program. Both management and the Board of Directors are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Petros Pharmaceuticals, Inc.

ticker: PTPI


text: Members of our executive management team are responsible for day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The individuals currently serving in these roles are our President and Chief Commercial Officer and our Vice President, Finance and Chief Accounting Officer. The executive management team monitors current events in order to remain aware of current cybersecurity threats. The executive management team is informed and alerted by our information technology ("IT") consultant and our frontline personnel of any specific incidents, in addition to cybersecurity risks. Our executive management will inform our Board of Directors of cybersecurity incidents if and when they may arise. Additionally, the Board considers risks from cybersecurity threats as part of its holistic assessment of the risks facing our business.


text: Our current cybersecurity risk assessment program consists of processes designed to assess, identify and manage cybersecurity risks, including the use of anti-virus software, multi-factor authentication and risky/suspicious log-in monitoring. We leverage the advice of third-party consultants, including our IT consultant, to help us assess and identify risks from cybersecurity threats, including the threat of a cybersecurity incident, and manage our risk assessment program. Among other things, these providers advise on best practices for safeguarding company data.


text: We also have policies and procedures to oversee and identify the risks from cybersecurity threats associated with our use of third-party service providers. Our third-party service providers provide us with SOC-1 reports, which document their internal controls, on a regular basis. Our executive management team reviews these reports as part of its assessment of the effectiveness of our internal control over financial reporting. We use such reports to assess and mitigate the risks associated with the use of third-party providers.


text: To date, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation, cause existing customers to discontinue purchasing our products, prevent us from attracting new customers, interfere with our efforts to pursue regulatory approvals for our product candidates, or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. For further information, see "Risk Factors— Cyberattacks and other data security breaches could compromise our proprietary and confidential information, which could harm our business and reputation or cause us to incur increased expenses to address any such breaches. " in Item 1A of this Annual Report on Form 10-K. We have attempted to preemptively mitigate the financial impact of any cybersecurity incident and currently maintain limited cyber liability insurance. However, our cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our cyber liability insurance may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.


text: Cybersecurity Management and Strategy Our business operations depend on the availability, integrity, and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers, and other third parties on which we rely. We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats, and as such, have implemented and maintain a cybersecurity risk management program to assess, identify and manage risks from cybersecurity threats. This program is integrated into our overall enterprise risk management process, and is embedded in our operating procedures, internal controls, and information systems. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks involving our vendors and service providers. However, we rely on the third parties to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: 5&2 Studios, Inc.


text: Conduct periodic vulnerability assessments and mitigate vulnerabilities for our systems and processes that include sensitive data Conduct regular security awareness trainings and phishing simulation attacks for our employees Maintain cybersecurity risk insurance that provides an aggregate insurance policy coverage amount for protection against covered losses arising from a cybersecurity incident Perform periodic gap analyses to review our cybersecurity controls for gaps and implement the closure actions;


text: Regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls set by organizations such as the National Institute of Standards and Technology cybersecurity framework and the International Organization for Standardization;


text: Maintain a dedicated cybersecurity team under the direction of our Chief Information Security Officer (the "CISO"), each of whom has expertise related to data and network security, data governance and risk management;


text: Maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf;


text: Maintain policies that require the escalation of any suspected or actual material cybersecurity incidents to our Board of Directors, and Have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.


text: Our incident response plan coordinates the activities that we take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: While we, our business partners and affiliates, and our vendors and service providers are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have had a material impact on our service, systems, business, financial condition, or results of operation of our business in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence. Any significant disruption to our service or access to our systems could adversely affect our business, results of operation and reputation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information or other sensitive information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. See "Risk Factors – Cybersecurity." Any significant disruption or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cybersecurity incidents or attacks, could result in a loss or degradation of service, unauthorized disclosure of data, including corporation information, or theft of intellectual property, including digital content assets, which could adversely impact our business."


text: Management has implemented risk management structures, policies, and procedures, and manages our risk exposure on a day-to-day basis. We have a cybersecurity organization within our operations department that focuses on current and emerging cybersecurity matters, which is overseen by our CISO. Senior management, including our CISO, regularly report to our Board, which actively oversees our risk management activities, including those related to cybersecurity. Our CISO is well qualified in the field of cybersecurity. These qualifications include years of experience in the IT and cybersecurity industry. The CISO works closely with key stakeholders, including internal committees such as the Finance and Audit Committee of the Board, in order to manage cybersecurity and information security risk. Our internal team, supplemented by outside cybersecurity advisors, is responsible for the testing and audit of our information-technology internal controls. In addition, leaders from our finance, legal and operations teams participate in incident response training designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency. The Finance and Audit Committee provides oversight relative to senior management's handling of cybersecurity risks.


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Board oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the data protection program, and performs reviews and assessments of the primary operational and regulatory risks facing the Company, their relative magnitude and management's plan for mitigating these risks. At least annually, our CISO reports to the full Board with a comprehensive report addressing a broad range of topics, including significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: As a blank check company, we have no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Annual Report, any sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure, or the systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Due to our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Annual Report. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Cartesian Growth Corp II

ticker: RENEF


text: Risk Management and Strategy We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying processes and controls of our program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). The program is subject to annual risk assessment by a third-party consultant to ensure compliance with the standards of the NIST CSF and to identify, quantify and categorize material cyber risks. In addition, with the assistance of the consultant, we have developed a risk mitigation plan to address cyber risks, and where necessary, remediate potential vulnerabilities.

companyName: Sachem Capital Corp.

ticker: SACH


text: Under this program, we employ additional key practices including, but not limited to, maintenance of an information technology ("IT") assets inventory, quarterly vulnerability testing, identity access management controls including restricted access of privileged accounts, physical security measures at our offices, maintenance of firewalls and anti-malware tools, ongoing cybersecurity user awareness training, industry-standard encryption protocols, and critical data backups.


text: Our cybersecurity partners, including a technology consultant and other relevant third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to maintain the performance and effectiveness of IT assets, data, and services. The cybersecurity partners provide services including, but not limited to, systems inventory management, vulnerability testing, user management, capacity monitoring, network protection, remote access management, data backups management, infrastructure maintenance, and cyber risk advisory, assessment and remediation. We also maintain a disaster recovery plan to help us quickly recover from an incident during a disruption and help mitigate the impact of certain cybersecurity risks.


text: Our management team, including the IT Manager, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of our cyber risk management program. Our management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making.


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cyber; incident. This includes a review of vendors during the selection/onboarding process, inclusion of formal service level agreements (SLAs) including requirements for uptime where applicable, and a periodic review of contracts.


text: We are in the process of formalizing the Audit Committee 's responsibilities to oversee our cybersecurity risk exposure and the steps taken by management to monitor and mitigate cybersecurity risks. Once these responsibilities have been established, the cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk advisory services will brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, the emerging threat landscape, and new cyber risks on at least an annual basis. This will include updates on our processes to prevent, detect, and mitigate cyber incidents. In addition, material cybersecurity risks and/or events, should they occur, will be reviewed by the Board, at least annually, as part of our corporate risk oversight processes.


text: We face risk from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. However, cyber incidents have not been identified to date, therefore having no material adverse effect on our business, financial condition, results of operations, or cash flows. We understand potential vulnerabilities to known or unknown threats remain and have implemented the cyber risk management program described above to stay up to date on attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable. Further, there is increasing regulation regarding responses to cyber incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm in the event of the occurrence of a reportable cyber incident. In response to such risks, we have implemented the aforementioned initiatives. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.


text: Risk Management and Strategy The Company relies heavily on its information systems, and the availability and integrity of these systems is essential to conducting its business and operations. As a producer of oil and natural gas, the Company faces various security threats, including cybersecurity threats, to gain unauthorized access to its sensitive information or to render its information or systems unusable, and threats to the security of its facilities and infrastructure or third-party facilities and infrastructure, such as gathering and processing and other facilities, and pipelines. This risk may be heightened as a result of an increased remote working environment, similar to the one created by the COVID-19 outbreak in 2020. The potential for such security threats subjects its operations to increased risks that could have a material adverse effect on its business, financial condition, results of operations and cash flows.

companyName: New ERA Energy & Digital, Inc.

ticker: NUAI


text: As the Company implements various procedures and controls to monitor and mitigate such security threats and to increase security for its information, systems, facilities and infrastructure it may result in increased costs. Moreover, there can be no assurance that such procedures and controls will be sufficient to prevent security breaches from occurring. If any of these security breaches were to occur, they could lead to losses of, or damage to, sensitive information or facilities, infrastructure and systems essential to its business and operations, as well as data corruption, communication interruptions or other disruptions to its operations, which, in turn, could have a material adverse effect on its business, financial position, results of operations and cash flows.


text: The Company is in the process of developing an information security program to address risks from cybersecurity threats. Management plans to engage a reputable third party with the appropriate expertise in IT and cybersecurity to develop these programs.


text: The Company may not be able to fully, continuously, and effectively implement appropriate security controls as intended. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Our Board is responsible for the oversight of cybersecurity risk management. The Board may assign this oversight a committee of the Board.


text: The Company's senior leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. During this process, these individuals may utilize third parties with the appropriate expertise in IT and cybersecurity to develop these programs.


text: Risk Management and Strategy We recognize the importance of managing the material risks of cybersecurity threats, and we have implemented processes for identifying and assessing cybersecurity risks and incidents. We have also integrated these processes into our overall risk management system, including senior management's periodic reviews of cybersecurity risks or threats. Senior management oversees and works closely with our IT department to continuously review and evaluate cybersecurity risks in alignment with our business goals and needs.

companyName: Cytosorbents Corp

ticker: CTSO


text: With respect to cybersecurity risks and threats, we utilize various third-party consultants and advisors to assist us with regular reviews, internal audits and best practices, including threat prevention and detection, security reviews and enhancements, penetration testing and full scope IT audits. CytoSorbents also has strict processes in place for the review of third-party service providers engaged, including thorough security assessments before engagement and annual monitoring of their IT environments and controls.


text: Our Chief Executive Officer and Chief Financial Officer are primarily responsible for timely updating the Board of Directors and the Audit Committee of the Board of Directors (the "Audit Committee") about any material cybersecurity incidents or threats or any cybersecurity related issues worthy of their attention.


text: Our Board of Directors has designated the Audit Committee as the primary committee responsible for reviewing and managing cybersecurity risks and threats at CytoSorbents. The Audit Committee is comprised of members of the Board of Directors with diverse experience in healthcare, finance and information technology, enabling them to effectively oversee cybersecurity risks and threats. Our management team, with assistance from third-party consultants or advisors as appropriate, provides quarterly updates regarding cybersecurity risks and threats to the Audit Committee and ad hoc updates or communications are provided to the entire Board of Directors as needed.


text: The IT Operations team is primarily responsible for the timely identification, review, severity assessment and management of cybersecurity incidents. In the event of a cybersecurity incident, the IT Department leadership follows the procedures outlined in our Cybersecurity Incident Response Policy and works closely with management to form a Security Incident Response Team comprised of members from the appropriate functional teams. In accordance with this policy, senior management will also communicate the occurrence of any significant cybersecurity incidents to our Board of Directors, Audit Committee and auditors on a timely basis and will keep them informed of the remediation plans and progress.


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees or customers violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. The Board has delegated primary responsibility for the oversight of cybersecurity matters to members of management who are responsible for implementing and maintaining our cybersecurity and data protection practices. Management reports to the Board at least annually on data protection and cybersecurity matters and reviews, and more frequently as needed. The Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: NORTHWEST BIOTHERAPEUTICS INC

ticker: NWBO


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any material cybersecurity incidents since our IPO.

companyName: Israel Acquisitions Corp

ticker: ISRLF


text: Cybersecurity Risk Management We maintain written policies and procedures that outline the Company's comprehensive information security program (CISP). The Chief Information Security Officer (CISO) has the responsibility for implementation and maintenance of the CISP. In addition to SEC and FINRA regulatory requirements, we leverage established security frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as guides to continually improve our policies and procedures. In addition, our employees are required to complete a cybersecurity training program each year, which is supplemented with additional awareness efforts, including phishing campaigns and informational notifications.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: We employ a variety of security tools and components to monitor, identify and block cybersecurity threats. In the event of a cybersecurity incident, the Company has an incident response team (IRT) whose role is to respond quickly and effectively. The IRT utilizes an incident response plan for the implementation of the its incident response capabilities that provides (i) a definition of "reportable incidents/events", and (ii) "metrics" for evaluating the IRT's response capabilities and effectiveness. The checklist is periodically reviewed by the IT Department for lessons learned from both mock and actual incidents, and to assure compliance with most current industry best practices and latest regulatory developments. The incident response plan includes processes through which cybersecurity incidents are escalated to the Company's executive officers. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises at least annually. These exercises are conducted by internal personnel.


text: Cybersecurity Committee The mission of the Cyber Security Committee is to be responsible for the cultivation of a corporate culture that recognizes risk awareness and the development of the Company's cyber security solutions, utilizing thought leadership, technology and systems, and development of applicable policies and procedures. Through its cyber security policy and procedures, the Committee will ensure effective collaboration and coordination between affected departments and staff in identifying and responding to both privacy and cyber security risks and events. The Committee will oversee the development and implementation of an enterprise-wide strategic framework related to the identification and prevention of cyber security threats as an integral part of the Firm's risk management process, otherwise known as CISP. The Firm's cyber security framework is intended to be "evolutionary", requiring (i) periodic reviews, and (ii) testing of systems, that result in changes to Company policy and procedures, as cyber security issues and developments require. The Committee shall be composed of specified members of senior management, department heads and staff, who have been selected based upon their backgrounds and experience involving IT, Risk Management, Operations, Compliance, and Legal. The Committee shall have the discretion to engage and utilize the services of independent vendors, computer service providers (eSP's) and consultants having expertise in the area of cyber security and IT. The Committee shall determine its meeting agendas and frequency of meetings which shall be reported through minutes prepared by the designated secretary.


text: Engagement of Third Parties We engage third-party subject matter experts and consultants to conduct evaluations of our security controls, including, but not limited to, penetration testing, auditing of our CISP or consulting on our response to cyber security threats and breaches. Results of these evaluations are used to help determine priorities and initiatives to improve the overall CISP. As necessary, we also engage third-party experts and consultants to assist with the incident response process to augment our internal security operation center team.


text: The Company will conduct initial and ongoing due diligence of each current or prospective third-party service provider to evaluate whether the third-party service provider will have access, maintain, or store any client private information. Vendor cybersecurity controls are then assessed to determine if the vendor's control environment meets the Company's standards. Vendors are also assessed on a periodic ongoing basis according to their risk classification.


text: We have not identified any cybersecurity incidents that individually, or in the aggregate, have materially affected or are reasonably likely to materially affect the Company. Regardless, we recognize cybersecurity threats are ongoing and evolving, and there can be no guarantee that we will not be subject to a cybersecurity incident that has a material effect on our business.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K.

companyName: Nabors Energy Transition Corp. II


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: IX Acquisition Corp.

ticker: IXAQF


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our information systems or infrastructure, or the information systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with the cybersecurity incident. As an early-stage company without significant investments in data security protection, there can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our Initial Public Offering.


text: Cybersecurity Risk Management and Strategy Entero Therapeutics, Inc. has established a comprehensive cybersecurity risk management program aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information. Central to our cybersecurity efforts is a robust incident response plan designed to address potential cyber incidents swiftly and effectively.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: In designing and evaluating our cybersecurity initiatives, we have adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) as a guiding principle. It's important to clarify that our use of the NIST CSF 2.0 is for guidance purposes to frame our risk identification, assessment, and management processes and does not equate to compliance with any specific technical standards or requirements.


text: Our cybersecurity framework is integrated into Entero's broader enterprise risk management strategy, sharing methodologies, reporting mechanisms, and governance structures with other risk domains including legal, compliance, strategic, operational, and financial risks. Conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;


text: A dedicated security consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents; Engagement with external service providers to evaluate, enhance, or support our security measures; Comprehensive cybersecurity training programs for employees, incident responders, and senior management to foster a culture of security awareness;


text: An incident response plan outlining specific procedures for managing cybersecurity incidents; and A thorough third-party risk management process to evaluate and manage risks associated with service providers, suppliers, and vendors.


text: To date, we have not identified any cybersecurity threats or past incidents that have had, or are likely to have, a material impact on our Company's operations, business strategy, financial performance, or results of operations.


text: Our external security expert has over thirty years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.


text: Cybersecurity Governance The governance of cybersecurity risks is a critical function of our Board of Directors, with the Audit Committee playing a key role in the oversight of cybersecurity and related technology risks. The Audit Committee is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.


text: The Audit Committee will receive regular updates from management on the state of cybersecurity risks facing the company. This will include briefings on any significant cyber incidents and ongoing risk management efforts. These updates will enable the Audit Committee to provide informed reports on cybersecurity matters to the full Board.


text: Our Audit Committee is actively involved in our cybersecurity oversight and under our new Cybersecurity Policy adopted on March 11, 2024, will receive detailed briefings from our external cybersecurity expert.


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Chief Financial Officer. This team is at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach includes regular updates from our external security expert, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.


text: As a blank check company, we have no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Due to our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Report. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Spring Valley Acquisition Corp. II

ticker: SVIIF


text: We have no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Papaya Growth Opportunity Corp. I


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of the data we use in our business, as well as our employee and clinical data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: We continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies.


text: The Company's Chief Operating Officer (COO) assumes a pivotal role in overseeing the cybersecurity risk management program. The COO collaborates with business leaders on the matters of cybersecurity across the Company.


text: Cybersecurity risks fall within the purview of the Audit Committee and, ultimately, the Board of Directors. Regular oversight and reviews occur at established intervals. The Audit Committee engages in discussions with the COO and Company management at least once a year, covering various aspects of cybersecurity risk management, including recent developments, evolving standards, vulnerability assessments, and the threat environment.


text: We measure our data security effectiveness by benchmarking against industry-accepted methods and we work to remediate any significant findings. We maintain and routinely test backup systems and disaster recovery and also have processes in place to prevent disruptions resulting from our implementation of new software and systems.


text: We have a comprehensive incident response plan to address cybersecurity incidents. Our incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting our information technology. To date, we believe that our cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of its information however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. Further, we currently maintain a cyber insurance policy that provides coverage for security breaches however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: We engage external parties, including consultants, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we also have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners, which includes certification of our major technology suppliers and any outsourced services through accepted security certification standards.


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, we have not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Risk Management and Strategy Our company recognizes cybersecurity as a critical component of its risk management strategy. We are committed to protecting our digital assets, customer data, and intellectual property from cyber threats. Our approach is guided by industry best practices and compliance with relevant cybersecurity standards and regulations including SOC 2, ISO 27001, and ISO 27701. We conduct regular assessments to identify potential cybersecurity threats and vulnerabilities that are then reviewed by external auditors as part of our annual SOC 2 Type 2 Review and ISO 27001 audit. This process includes evaluating external threat landscapes, internal systems, and processes for susceptibility to cyber-attacks. We utilize both in-house expertise and external consultants to ensure a comprehensive assessment. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Moatable, Inc.

ticker: MTBLY


text: Our information technology department collaborates with our security and compliance team (a cross-functional team), product development department and the legal department to help identify, assess and manage the company's cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile, using various methods including, among others, manual and automated tools, internal and external audits, third-party threat assessments and external intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including but not limited to IT policies (incident management plan, stake-holder engagement, incident response plan, DR plan, etc.) incident detection and response, and vulnerability detection and management, preventative controls including firewalls, secure coding practices and IDS, annual disaster recovery testing, data segregation and encryption (at rest and in-transit), network security controls and access controls, asset management, tracking and disposal, vendor management, employee training and awareness and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the information technology department, security and compliance team and product development department work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and our senior management, such as our chief executive officer, evaluates material risks from cybersecurity threats against our overall business objectives and reports to our board of directors, which evaluates our overall enterprise risk.


text: Additionally, we use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Such third-party service providers include professional service firms including outside legal counsel, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services providers, and forensic investigators. These third-party service providers perform a variety of functions for our company, and we maintain a robust vendor management program to manage cybersecurity risks associated with our use of these providers. For example, we conduct risk and security assessment for potential vendors and their programs and periodically review such assessments; and we require our vendors to complete security questionnaires and conduct audits and vulnerability scans related to them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect our company, see "Item 1A. Risk Factors—Risks Related to Our Business and Industry—Cyber-attacks, computer viruses, physical or electronic break-ins or other unauthorized access to our or our business partners' computer systems could result in misuse of confidential information and misappropriation of funds of our customers, subject us to liabilities, cause reputational harm and adversely impact our results of operations and financial condition.," and "—We rely on sophisticated information systems and third-party cloud infrastructure to run our business. The failure of these systems, any service disruptions or outages, or the inability to enhance our capabilities, could have a material adverse effect on our business, sales, and results of operations."


text: Our board of directors recognizes the critical importance of cybersecurity in safeguarding our company's assets, reputation, and customer trust. Our board of directors addresses our company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management members, including our chief technology officer for Lofty and Trucker Path, our virtual chief information security officer, and our global IT manager.


text: Our cybersecurity incident response policy and vulnerability management policy are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our chief technology officer. These management members work with related incident response functions, including the information technology department, the product development department and the legal department, to help the company mitigate and remediate cybersecurity incidents of which they are notified.


text: Artificial Intelligence AI possesses the potential to transform various work sectors significantly. Currently, we are in the early stages of enhancing and broadening our offerings with AI technologies, aiming to assist our clients in tackling current challenges. Our dedication lies in actualizing AI's potential while ensuring ethical practices. Our approach is underpinned by fundamental values: ensuring equity, dependability, and safety, maintaining privacy and security, promoting inclusiveness, upholding transparency, and embracing accountability.


text: We are a SPAC with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable target businesses. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Angel Studios, Inc.

ticker: ANGX


text: We believe cybersecurity is critical to us because we are conducting material operations. Cybersecurity threats have not affected our business strategy or results of operations. The Board of Directors will continue to assess the potential threat to future operations as such operations develop. The Board of Directors will oversee management's processes for assessing, identifying and mitigating risks, including cybersecurity risks, to facilitate mitigating our risks involved with cybersecurity and help align our risk exposure with our strategic objectives. The Board relies on its executive officers to identify cybersecurity risks and retains oversight of cybersecurity. In the event of an incident, we intend to take appropriate steps from incident detection to mitigation, recovery and notification of appropriate parties. Management is responsible for day-to-day monitoring of cybersecurity, including detection and response and to report risks and incidents to the Board of Directors. We rely on computer software provided by third parties to protect our computer systems against cybersecurity threats.

companyName: SUNRISE REAL ESTATE GROUP INC

ticker: SRRE


text: Organizations are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. The Company maintains general cybersecurity policies and procedures to assess, identify, and manage cyber threats, and has designated personnel to implement and maintain these policies and procedures, subject to oversight by our management.

companyName: ScanTech AI Systems Inc.

ticker: STAI


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are based on recognized frameworks established by industry standards. The Company has established and maintains incident response and recovery plans to address potential cybersecurity incidents. It has implemented a range of technical, physical, and administrative security controls to mitigate cybersecurity threats, including measures specifically focused on network security, data protection, and safeguarding information that, if compromised, could adversely affect the public interest or the Company.


text: The Company's employees are also required to sign confidentiality agreements in an effort to, among other things, help to ensure cybersecurity. The Company has taken measures to better ensure that key employees are aware of data security threats (including cybersecurity threats), and Company security policies and procedures, as appropriate. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures may result in disciplinary action.


text: The Company relies on third-party service providers for critical or key infrastructure and solutions across various Company operations. Cybersecurity incidents that impact third-party service providers have significantly increased in recent years and represent a continuing risk to the Company. The Company has sought to mitigate this risk through specific cybersecurity controls, designed to assess the business and security controls implemented by key information services to the Company. The management assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: We maintain robust and comprehensive processes, procedures and controls to protect and secure our information systems and data infrastructure from cybersecurity threats. Our cybersecurity program is led by our Vice President of Technology, who functions as our chief information security officer (" CISO "). Our CISO has over 20 years of experience in information technology leadership and information security, serving in roles of increasing responsibility within private and public companies. Our cybersecurity program interfaces with other functional areas within the Company, including but not limited to our business segments and information technology (" IT ") and legal departments, as well as external third-party partners, to identify and understand potential cybersecurity threats, including those associated with any third-party service providers we may use. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments. We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the International Organization for Standardization (" ISO ").

companyName: Reservoir Media, Inc.

ticker: RSVR


text: Our cybersecurity risk program is integrated into our overall enterprise risk management assessment, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program. Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate our employees regarding cybersecurity. The CISO also manages our Incident Response Team, which includes a team comprised of executives from various cross - functional management teams, internal technical support roles and external third - party service providers. The Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third - party service providers based on type and severity of the specific incident.


text: We also require cybersecurity training for relevant employees, focusing on the appropriate protection and security of confidential company and third-party information. The IT team provides regular updates to senior management on various cybersecurity threats, assessments and findings, and the effectiveness of the Company's cyber risk management program. Our Board of Directors through the Audit Committee oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Disclosure Committee and Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. However, the sophistication of cyber threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cyber incidents and protect our systems and information may not successfully protect against all cyber incidents. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further action, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors–If we or our service providers do not maintain the security of information relating to our customers, employees and vendors and our music, security information breaches through cyber security attacks or otherwise could damage our reputation with customers, employees, vendors and artists, and we could incur substantial additional costs, become subject to litigation and our results of operations and financial condition could be adversely affected."


text: We face many cybersecurity threats including ransomware, denial-of-service attacks, business email compromise, and persistent threats from state-affiliated groups. We have experienced cyber-attacks in the past and may experience cybersecurity incidents in the future. While prior incidents have not materially affected our business, results of operations or financial condition, there is no guarantee that a future cyber threat or cyber incident would not affect our business strategy, results of operations or financial condition. See Item 1A. Risk Factors for more information on our cybersecurity risks.

companyName: AAR CORP

ticker: AIR


text: Risk Management and Strategy We maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. Our cybersecurity strategy and risk management processes use the National Institute of Standards and Technology governance requirements and cybersecurity framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our approach to cybersecurity risk management includes multiple complementary elements to mitigate our cybersecurity risks. We utilize multi-layered defenses to help prevent attacks including the use of data analytics to help detect anomalies and search for cyber threats. We have comprehensive cyber threat detection and response capabilities with applied threat intelligence, and continuous monitoring to complement other technology, processes and threat detection techniques we have in place. We subscribe to third-party managed security services that continuously monitor our systems and networks to assist with early cybersecurity threat detection and protection.


text: We work with government, customer, industry and/or supplier partners to gather and develop policies and standards and share information to address cyber threats. We conduct information security assessments of partners before sharing or allowing the hosting of data in computing environments managed by third parties. We require our employees to complete phishing and other awareness training to help identify, avoid and mitigate cybersecurity threats.


text: While our primary focus is on prevention and detection of cybersecurity threats, we have response and recovery plans in effect, as well as service agreements with outside experts should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The detailed plan defines the roles and responsibilities of all parties included in our cybersecurity incident response team which incorporates our IT team, senior management, and other functional areas.


text: We also have controls and procedures for reporting material cybersecurity incidents, including review of significant cybersecurity incidents by a cross-functional team to determine whether further escalation is necessary. We also periodically conduct practice exercises with management to familiarize the management team with our cyber incident response capabilities and processes. We also conduct internal and third-party assessments or penetration tests to validate our cybersecurity controls and improve our security posture. We also maintain cybersecurity liability insurance coverage.


text: Our Chief Information Security Officer ("CISO") partners with management in internal functions, such as finance, legal, and internal audit, in overseeing information security risks, as well as third-party consultants who perform risk-based assessments with recommendations for designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategies, which helps align our programs and strategies with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee and the Board of Directors.


text: To facilitate the prevention, detection and timely response to information security threats, we have a dedicated CISO whose team is responsible for managing our information security strategy, policies, standards, and processes. The information security team provides security monitoring and response and provides regular reports to the CISO to inform about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks. The CISO, who also serves as our data protection officer, reports directly to our Chief Digital & Technology Officer ("CDTO"), who reports directly to our Chairman, President and Chief Executive Officer.


text: Our CISO and CDTO have extensive experience and expertise in developing, implementing, and operating security policies and procedures covering our network and critical data. Our CISO has 35 years of experience in information technology systems and is a 25-year military veteran of the U.S. Navy and Navy Reserves with a Top Secret/Sensitive Compartmented Information (TS/SCI) U.S. security clearance and multiple combat deployments in information warfare. Additionally, our CISO holds several certifications, including, among others, the following security certifications: Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Network Defense Analyst (CNDA), Disaster Recovery Institute International (DRII), and CompTIA – Network+ and Security+. Our CDTO has over 25 years of leadership experience across all aspects of technology-enabled digital transformations, including leading multiple transformations at a major airline prior to his role at AAR. He previously advised companies across multiple industries in collaboratively developing and executing their digital and technology roadmaps as a consultant at a major firm.


text: The CDTO and CISO regularly review cybersecurity matters with members of our senior management. These discussions include the latest cybersecurity risks and threats, the status of our cybersecurity incident response plan, and our overall process relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Board of Directors, through its Audit Committee, is responsible for overseeing our cybersecurity risk management. On a regular basis, the Board of Directors or Audit Committee receive and review reports from the CDTO and CISO relating to the status of cybersecurity planning and protections, the overall state of our cybersecurity program, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks.


text: The Company has cybersecurity risk management processes, including physical, technological and administrative controls, intended to protect the confidentiality, integrity and availability of the Company's information technology infrastructure and systems or any information residing therein. The Company relies on third party service providers to operate, maintain and monitor its information technology infrastructure and systems and to assess, identify and manage material risks from cybersecurity threats with respect thereto. The Company's management monitors its service providers. The Company's service providers are tasked with notifying the Company's management of any material cybersecurity incident that negatively impacts the Company's information technology infrastructure and systems or any information residing therein. Material and potentially material cybersecurity incidents would be assessed by the Company's executive officers for remediation and future prevention and detection.

companyName: AMREP CORP.

ticker: AXR


text: Notwithstanding the Company's processes for assessing, identifying and managing risks from cybersecurity threats, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. During 2025 and 2024, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: The Board of Directors of the Company oversees the Company's risk management program as part of its general oversight function. The Board of Directors has delegated to the Audit Committee of the Board of Directors of the Company the responsibility for reviewing and discussing with management the Company's policies with respect to risk assessment and risk management and for reviewing contingent risks that may be material to the Company, including cybersecurity risks. The Audit Committee engages in regular discussions with the Company's executive officers regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks, including cybersecurity risks. The Audit Committee also reports relevant material information regarding any such risks to the Board of Directors. The Company's executive officers are responsible for identifying and assessing material risks for the business on an ongoing basis, including cybersecurity risks. Although the Company's executive officers do not have cybersecurity expertise, their experience managing the Company, which includes consulting and coordinating as necessary with its service providers, enables them to effectively assess and manage material risks from cybersecurity threats.


text: We rely upon internally and externally managed information technology systems and networks for the collection and storage of sensitive data and business information. We approach cybersecurity risks with a comprehensive risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to our business.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: Risk Management and Strategy Our cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect our information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned, or managed by us. Our focus is on protecting sensitive information, such as the personal information of our customers and employees, and confidential business information that a competitor or a malicious actor could leverage. Our cybersecurity program has several components, including the adoption of information security protocols, standards, and guidelines consistent with industry best practices and engaging third-party service providers to conduct security assessments.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We conduct regular risk assessments to identify cybersecurity threats and assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards.


text: We have implemented technical solutions designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware and endpoint protection functionality, and access and identity controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards.


text: We have not experienced any cybersecurity incidents that have been determined to affect us materially, our business strategy, results of operations, or financial condition. As external events evolve, we will continue to evaluate and address these conditions as needed.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Cybersecurity Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We and our subsidiaries currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. Our IT staff along with the third-party providers and outsourced IT services monitor and address cybersecurity related risks, including installing software for threat protection and malware. Our IT staff and such third-party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate.

companyName: TECHPRECISION CORP

ticker: TPCS


text: We continue to work with outside counsel and third - party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors," in this Report. We maintain a cyber liability insurance policy. However, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.


text: Our Chief Executive Officer is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from our IT staff and third-party service providers. Our IT staff at both Ranor and Stadco oversee their respective cybersecurity processes on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above, and escalate matters to our Chief Executive Officer as appropriate.


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Our Chief Executive Officer provides periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.


text: We are a blank check company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for an initial business combination. Therefore, we do not believe that we face significant cybersecurity risks and have not adopted any cybersecurity risk management programs or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Relativity Acquisition Corp

ticker: ACQC


text: Once we are operational and have available funding, we will be committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we plan to implement a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets.


text: Risk Management and Strategy We maintain high standards with respect to cybersecurity and our cybersecurity risk management program is integrated into our enterprise risk management framework, overseen by our Information Security Officer ("ISO"), meaning that cyber-risks are identified, evaluated, and managed with the same rigor as other strategic, operational, and financial risks. We have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles as a guide for our security controls and processes, helping us structure our activities around identifying potential threats, protecting systems, detecting incidents, responding to events, and recovering operations. We engage independent third-party cybersecurity auditors and testers annually to review our Information Security Management (ISMS) and renew our ISO/IEC 27001 certification. Key elements of our program include:

companyName: OSI SYSTEMS INC

ticker: OSIS


text: Preventive Controls and Monitoring: We employ multiple layers of technical controls (firewalls, intrusion detection systems, encryption, and multi-factor authentication) to proactively monitor IT controls to ensure compliance with security policies, legal regulations, contractual obligations and industry best practices. Our Global Security Operations Center operates 24/7 with real-time monitoring capabilities to rapidly investigate alerts and trigger containment measures, which helps us minimize exposure or damage if a cybersecurity incident occurs.


text: Vulnerability Management and Testing: We conduct regular vulnerability assessments and annual external penetration testing of our systems and applications to probe for weaknesses. We also perform periodic exercises simulating cybersecurity incidents to test our defenses and response procedures. Findings from these tests are used to strengthen our security posture on an ongoing basis.


text: Incident Response Planning: We maintain a cybersecurity incident response plan that defines procedures for addressing security events. This plan is updated and tested regularly (including through tabletop drills and simulated breach exercises) so that our teams remain practiced in incident handling. In the event of an incident, our aim is to respond swiftly to contain the issue, notify appropriate stakeholders, investigate the root cause, and recover normal operations as soon as practicable.


text: Third-Party Risk Management: We carefully manage cybersecurity risks arising from our use of third-party software, cloud services, and suppliers. We perform due diligence and security risk assessments on critical third-party service providers, both at onboarding and periodically during the relationship. Our procurement and legal teams work together to incorporate robust cybersecurity requirements into contracts with vendors (for example, data protection standards and incident notification obligations). Where appropriate, we require suppliers to adhere to our security policies or industry standards, and we conduct ongoing monitoring or audits of their security controls. These steps help reduce the risk that a weakness in a partner's systems could compromise our data or operations.


text: Employee Training and Awareness: A strong security culture among our employees is one of our best defenses in relation to cybersecurity events. Our employees are required to complete annual cybersecurity and data protection awareness training. This training educates personnel on topics like phishing prevention, safe computing practices, and how to report potential security issues. We supplement formal training with periodic phishing email simulations and security reminders.


text: Through a combination of these technical, procedural, and educational measures, our program is designed to detect and respond to cybersecurity threats effectively and thereby safeguard our business operations and sensitive information.


text: Cybersecurity threats are endemic to the modern business environment, and attempts to penetrate our network security are frequent and on-going. However, to date, no cybersecurity threats (including incidents) have resulted in a material impact on our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident, that we will not experience a cybersecurity incident in the future, or that a past cybersecurity incident will not result in a future material impact. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Governance and Oversight We have established strong governance practices to oversee cybersecurity and IT risks. The Board of Directors has delegated primary oversight responsibility for cybersecurity to the Risk Management Committee (RMC) of the Board, which is composed of several Board members. Our Chief Information Officer (CIO) and Information Security Officer (ISO) receive security reports and threat intelligence from the Security Operations Center, which apprises the CIO and ISO of any potential incidents and the status of ongoing preventive measures and they share this information at least quarterly with the RMC. They also brief the full Board as needed on cybersecurity matters.


text: We have a multi-disciplinary Cybersecurity Council that connects our Information Security, IT, Corporate Audit, Finance, Legal, Compliance, and Investor Relations teams. This Council facilitates coordination of cybersecurity risk management across our organization and a unified response to incidents. In the event of a cybersecurity incident, the ISO will lead our incident response efforts and convene the Cybersecurity Council to evaluate the situation and determine appropriate next steps (for example, engaging law enforcement or cyber-experts, and considering disclosure obligations). This integrated governance structure – from the operational teams up through senior management and the Board – helps drive accountability and visibility for cybersecurity throughout our organization.


text: Our leadership team includes seasoned professionals with deep expertise in technology and security. Our CIO, Todd Weathersby, has more than 25 years of experience in global IT and cybersecurity management, and our ISO has more than 25 years of experience in cybersecurity, risk, and compliance (with certifications such as CISSP and CISM). The knowledge and experience of our CIO and ISO, along with the Board's active engagement, provides a strong oversight of our cybersecurity strategy. The Board and management also receive regular briefings and training sessions regarding emerging cybersecurity threats and regulatory developments in order to be positioned to adapt to new challenges in the cybersecurity landscape.


text: The Company's Cybersecurity Program The Company's cybersecurity program is an integral part of the long-term sustainability and effectiveness of the Company's operational and technology environment. To protect the integrity of its data and operational and technology systems, the Company employs a "defense-in-depth" strategy that uses multiple security measures. This strategy aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. The Company periodically reviews and modifies the implementation of its cybersecurity strategy based on threat trends, program maturity, the results of assessments, and the advice of third-party security consultants.

companyName: American Water Works Company, Inc.

ticker: AWK


text: The Company's cybersecurity program includes the following areas of focus: • Technology that includes, among other things, encryption, threat management, monitoring, investigation support and backups for physical devices, such as mobile phones and computers, connected to the Company network; • Identity and access management controls that include, among other things, multi-factor authentication and safeguards associated with granting elevated privileges; • Proactive cybersecurity processes, including vulnerability scanning, penetration testing and periodic program assessments by outside security consultants and assessors; • Reactive cybersecurity processes that are regularly evaluated using various incident response and disaster recovery exercises; • Employee cyber risk awareness and training, including regular simulation exercises with employees, that covers cybersecurity threats and actions to prevent and report attacks; and • Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring and contractual obligations, and periodic review of third-party control environments to align the Company's risk exposure with its business requirements and risk tolerances.


text: Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations and has implemented a third-party risk management program to understand the cybersecurity risks to the Company that may arise out of these third-party relationships. The Company categorizes third-party relationships by risk level, which is determined primarily by the service provided by the third-party and its level of access to the Company's data. Each category has specific cybersecurity controls, data privacy and documentation requirements, which are outlined in the agreement between the Company and the third-party service provider. In addition, the Company evaluates the online security footprint for its service providers at the time of agreement, and on a regular basis, thereafter, depending on the provider's risk level. The Company reviews its agreements with third-party service providers periodically related to terms and conditions governing cybersecurity controls and data privacy. The Company also monitors, as appropriate, risks relating to potential compromises of sensitive Company information through third parties and reevaluates these risks periodically. In addition, the Company obtains annual attestation reports related to data security and privacy from certain third-party providers to further support compliance with industry-standard cybersecurity protocols.


text: Cybersecurity Risks The Company believes that its current preventative actions and response activities provide reasonable measures of protection against security breaches and serve generally to reduce the Company's overall cybersecurity risk. However, cybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In addition, the Company has obtained insurance to provide coverage for a portion of the losses and damages that may result from a cyber attack or a security breach, but such insurance is subject to exclusions, limitations and exceptions, and may not cover the total loss or damage caused by an attack or breach. To date, management has determined that no cybersecurity incident experienced by the Company has resulted in a material impact on its financial condition, results of operations or business strategy. For additional information concerning cybersecurity-related risks, see Item 1A—Risk Factors—We may be subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured.


text: Cybersecurity Risk Management and Strategy The Company has established an enterprise-wide cybersecurity program designed to prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, and to timely identify, escalate and promptly remediate and recover from cybersecurity incidents and facilitate compliance with regulatory and disclosure requirements. To oversee cybersecurity risk management, the Company employs a dedicated unit, led by the Company's Chief Security Officer ("CSO"), to implement cybersecurity controls, assess and report on cybersecurity risks and consult with the Company's internal Enterprise Risk Management Committee, a decision-making body which supports and oversees the identification, assessment, prioritization, and mitigation strategies for enterprise-level risks, including cybersecurity risks. The Company's CSO has 23 years of work experience in the cybersecurity field throughout various industries, including the utility sector, and has obtained several professional certifications, including from the International Information System Security Certification Consortium. The CSO reports directly to the Company's Chief Information Officer ("CIO"), who is responsible for the Company's information technology program. The CIO has over 25 years of work experience in the information technology, physical security and cybersecurity fields, including previously serving as the Company's CSO, and holds the Certified Protection Professional, Professional Certified Investigator and Physical Security Professional certifications from ASIS International. The CIO serves on the Water Sector Coordinating Council ("WSCC"), an advisory body comprised of representatives from various U.S. water and wastewater organizations, which serves as a policy, strategy and coordination mechanism for the water sector on critical infrastructure security and resilience issues. In that role, the CIO partners with representatives from the Department of Homeland Security and the EPA on U.S. water and wastewater sector initiatives. The CIO is also the former Chair of the WSCC, the National Association of Water Companies' Safety and Security Committee, and the ASIS Utility Security Council.


text: The Company's security team provides oversight and policy guidance on physical, cyber and information security, as well as business continuity, throughout the Company's operations. It is responsible for designing, implementing, monitoring and supporting effective physical and technical security controls for the Company's physical assets, business systems and operational technologies. The Company's security team also conducts annual and ongoing cybersecurity awareness training and education for the Company's employees. In 2023, 100% of the Company's active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce.


text: The Company's cybersecurity risk assessment process involves considering risks associated with the nature of its business, receiving and processing inputs from internal and external stakeholders, monitoring industry trends and risks and engaging external advisors, to assist in aligning the Company's cybersecurity processes with industry best practices. Risk assessments are conducted quarterly and annually to evaluate the effectiveness of the Company's existing security controls and serve as the basis for additional safeguards, security controls and measures. Operational and technical security controls are deployed and integrated as safeguards against unauthorized access to the Company's information systems. These controls are aimed at (i) assuring the continuity of business processes that are dependent upon automation, (ii) maintaining the integrity of the Company's data, (iii) supporting regulatory and legislative compliance requirements, and (iv) maintaining safe and reliable service to the Company's customers.


text: The Company has also implemented a vulnerability assessment program that is conducted at least annually and more frequently, depending on the nature of the risk. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company's cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company's internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company's exposure to material cybersecurity threat risks.