text: Oversee Third-party Risk Third parties with which the Company does business or that facilitate the organization's business activities (e.g., vendors, supply chain, exchanges, clearing houses, etc.) are also sources of cybersecurity risk. Third-party cybersecurity incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises, could affect their ability to deliver a product or service or result in lost or compromised information. Because we are aware of the risks associated with third-party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Monitoring includes quarterly assessments by our Chief Information Security Officer ("CISO") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: OLD SECOND BANCORP INC

ticker: OSBC

secItem: Item 1C


text: Our Information Technology Steering Committee ("ITSC") is central to the Board's oversight of cybersecurity risks, which are incorporated into our overall risk management program overseen by our Board Risk Committee. These Committees meet no less than quarterly and are composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. While, as of the date of this Annual Report on Form 10-K, we have not encountered cybersecurity challenges that have materially impaired our operations or financial standing, our systems and those of our customers and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future.


text: Management's Role Managing Risk While the ITSC and our Board of Directors to which it reports oversees cybersecurity risk management, management is responsible for the day-to-day cybersecurity risk management processes. The Chief Risk Officer ("CRO") and the CISO play a pivotal role in informing the ITSC and Board Risk Committee on cybersecurity risks. Comprehensive briefings are presented to the ITSC and Board Risk Committee on a regular basis, with a minimum frequency of quarterly. These briefings encompass a broad range of topics, including: Maturity of our cyber landscape commensurate to inherent risks of environment;


text: Emerging threats Status of ongoing cybersecurity initiatives and strategies Incident reports and learnings from any cybersecurity events Compliance with regulatory requirements and industry standards; and Results of internal and external testing of cybersecurity controls. In addition to our scheduled meetings, CISO maintains an ongoing dialogue with management and the Board of Directors regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The CISO actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The CISO conducts a quarterly review of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity and operational risk, he brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO and holds several certifications including ISACA's, CISM and CRISC and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity training program.


text: The CISO is responsible for identifying technology and cybersecurity risks and is responsible for the controls to manage threats. To help safeguard the confidentiality, integrity and availability of our infrastructure, resources and information, we maintain an Information Security Program designed to prevent, detect, and respond to cyberattacks. The ITSC and Board of Directors is periodically provided with updates on the Information Security Program, recommended changes, cybersecurity policies and practices, ongoing efforts to improve security, as well as our efforts regarding significant cybersecurity events.


text: The CISO conducts a quarterly review of our inherent risk posture against the effectiveness of our cyber risk management strategies. This review helps in measuring the effectiveness of controls and identifying areas for improvement ensuring cyber controls is commensurate with our inherent risk profile and the Board's risk appetite.


text: Monitoring Cybersecurity Incidents The CISO continually monitors for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We deploy defense-in-depth safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments as well as ongoing acquisition of knowledge crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and prevent escalation of any loss or damage from the cybersecurity incident. The Incident Response Plan is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response teams (i) include subject matter experts to address cyber threats and (ii) includes representatives from the accounting team to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice.


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs the ITSC and Board Risk Committee of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we face. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: For additional information regarding the risk we face from cybersecurity threats, please see the risk factor titled "Our information systems may experience an interruption or breach in security and cyber-attacks, all of which could have a material adverse effect on our business." included in Part I. Item 1A. - Risk Factors of this report.


text: We have established processes, procedures, and controls to identify, manage, assess, and mitigate material risks from cybersecurity threats which are designed to help protect our information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while ensuring business resiliency, protecting employee and customer information from unauthorized access or attack, and securing our networks, systems, devices, products, and services, or our Cybersecurity Risk Mitigation Practices. We conduct tests on our systems and incident simulations to help discover potential vulnerabilities and ensure the effectiveness of our Cybersecurity Risk Mitigation Practices. We engage external parties, including consultants, independent privacy assessors, computer security firms, and risk management and governance experts, to enhance our cybersecurity oversight. We also regularly consult with industry groups on emerging industry trends. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners.

companyName: PC CONNECTION INC

ticker: CNXN


text: As of the date of this Annual Report Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risks titled "Cyberattacks or the failure to safeguard personal information and our IT systems could result in liability and harm our reputation, which could adversely affect our business" and "Our business could be materially adversely affected by system failures, interruption, integration issues, or security lapses of our IT systems or those of our third-party providers," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our Cybersecurity Risk Mitigation Practices are managed on a day-to-day basis by members of our Information Security Steering Committee, or the Committee, and are overseen by our Board of Directors. The Committee is composed of senior management, including our Chief Information Officer and Chief Financial Officer, and senior vice presidents from various areas of the organization including IT, compliance, legal, operations and human resources, including the Vice President of Information Security and Compliance. The Vice President of Information Security and Compliance has over 40 years of IT experience and is a certified information systems security professional.


text: As part of the administration of our Cybersecurity Risk Mitigation Practices, the Committee is tasked with managing and mitigating our exposure to cybersecurity threats, creating our cybersecurity policies, and establishing short and long- term cybersecurity goals and objectives that are designed to protect our information systems. The Committee is also responsible for planning ordinary course security projects and initiatives aimed at ensuring that our organizational leaders are informing our employees about our cybersecurity policies and about cybersecurity basic practices. On a periodic basis, the Committee meets to review the performance and effectiveness of our Cybersecurity Risk Mitigation Practices.


text: Members of the Committee will present the results of the periodic performance and effectiveness review to our Board of Directors, who oversee our risk management processes directly and through its committees. These results, along with other cybersecurity topics including updates on previously identified material cybersecurity threats or incidents, are presented at regularly scheduled meetings. Members of the Committee will also notify our Board of Directors between such meetings regarding significant new cybersecurity threats or incidents.


text: We operate through our subsidiaries and receive services through our intercorporate services agreement (ISA) with Contran (see Note 17 to our Consolidated Financial Statements). We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: VALHI INC /DE/

ticker: VHI


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer (CIO) who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology (IT). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating reporting units. Both our CIO and the CompX director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review enterprise risk management level cybersecurity risks annually.


text: We, Kronos and CompX continually enhance our security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We, Kronos and CompX engage third-party services to conduct evaluations of our security controls through penetration testing, red team testing, consulting on best practices and to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, with incidents evaluated to be high or critical security risks brought to the CIDAC for review and evaluation. Incidents are evaluated to determine materiality as well as operational and business impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. External resources and advisors are incorporated as needed.


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief financial officer and CIO, regularly brief the board of directors on our cybersecurity and information security posture, and our board of directors is apprised of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.


text: In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification. This includes notifying functional areas (such as legal and human resources), senior leadership and the board as appropriate.


text: We, Kronos and CompX face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- "Risk Factors".


text: We maintain standard procedures to help assess, identify and manage material risk posed by cybersecurity threats and regularly evaluate how we can integrate these procedures into our overall risk management processes. For example, we require that all of our employees who have access to our internal network complete formal cybersecurity training upon hire and on a periodic basis, including training on phishing, malware, and other cybersecurity risks. We also continuously evaluate our information technology systems and our practices that relate to our information technology systems. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with these efforts but may elect to do so in the future.

companyName: BIO-PATH HOLDINGS, INC.

ticker: BPTH


text: To the extent we identify areas in our information systems that need improvement, we seek to timely implement and monitor such improvements. While we believe that we have taken appropriate security measures to protect our data and information technology systems, and have been informed by our third-party vendors that they have as well, there can be no assurance that our efforts will prevent breakdowns or breaches in our systems, or those of our third-party vendors, that could materially adversely affect our business and financial condition. For additional information regarding whether risks from cybersecurity threats are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the functions of our Board is to identify principal risks of the Company and ensure implementation of appropriate systems to manage these risks, including risks from cybersecurity threats. Our Board works with members of management to identify and manage these risks, including cybersecurity risks. We currently employ a qualified Director of Information Technology and Data Management Systems who reports to our Chief Executive Officer. This employee has over 20 years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.


text: Our information technology employee regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. To the extent necessary, our Chief Executive Officer reports such risks to our Board.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Clarus Corp

ticker: CLAR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework) and seek to follow industry best practices to identify, assess, and manage cybersecurity risks relevant to our business.


text: We conduct annual risk assessments to identify cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management and assessment process also encompasses cybersecurity risks associated with our use of third-party service providers.


text: As part of our overall risk management and assessment program, we design, implement, and maintain reasonable safeguards to minimize potential risks, including cybersecurity risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We also regularly provide cybersecurity awareness training to employees at all levels and departments across the Company. The Company believes that we have allocated adequate resources to address the cybersecurity threats that may reasonably affect us.


text: Our cybersecurity team, consisting of the VP of Information Technology, Director of Information Security, and Director of Infrastructure, is principally responsible for managing our cybersecurity risk assessment processes, our security controls, mitigation process and our response to cybersecurity threats. The Company also participates in a cybersecurity risk insurance policy.


text: For additional information regarding cybersecurity threats that may materially affect the Company, including our business strategy, results of operations, and financial condition, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: One of the functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole and through its committees.


text: In particular, the Audit Committee of our Board of Directors monitors and assesses our financial, legal and operational risks, and receives regular reports from the management team regarding comprehensive organizational risk as well as particular areas of concern, which includes, but is not limited to, cybersecurity risks, related mitigation, and other related responses and activities.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Our business operations rely on the secure collection, storage, transmission, and other processing of confidential and sensitive data through our information systems. In addition, as a financial services company, we are subject to extensive regulatory compliance requirements concerning the treatment of such data. To ensure the security, confidentiality, integrity, and availability of our information systems, we have implemented a comprehensive cybersecurity risk management program (the "Information Security Program"). The program is designed to identify, assess, manage, and mitigate risks and secure Company and customer information against threats. This is achieved through monitoring, threat management strategies, policies and procedures, security awareness, oversight, and governance.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: The Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO") provide direct oversight and management of the cybersecurity risk management program. The CISO and the Information Security team assess and manage the day-to-day cybersecurity and threat management programs. Our CISO has more than 20 years of relevant experience in leading and building risk management and cybersecurity programs. Our CISO maintains the following credentials: Certified Information Systems Auditor and Certification in Risk Management Assurance. The CRO and CISO report periodically on important updates related to the Information Security Program and threat landscape to the Board of Directors and its designated committee with responsibility for oversight of risk management.


text: There are also several Management committees that are responsible for oversight of the Information Security Program. These include: • Information Security Committee; and • Risk Management Committee.


text: The Information Security Committee ("ISC") is chaired by the CISO and is responsible for overseeing cybersecurity risk, including information security policies and procedures, information security audits, social engineering testing, vulnerability management, penetration testing, information security projects, business continuity, incident response planning, and current threats and security advisories related to the bank's information systems and data assets. The ISC members include the CRO, Chief Information Officer, and General Counsel, with broader attendance from representatives of Risk Management, Technology, Operations, Internal Audit, and Retail. The ISC, in turn, provides a summary update and points of escalation to the Risk Management Committee ("RMC"), who is chaired by the CRO.


text: The RMC serves as the primary Management committee in fulfilling enterprise risk management oversight responsibilities, including cybersecurity risk. The RMC provides quarterly updates to the Audit Committee.


text: The Board of Directors holds oversight responsibility over the Company's risk management program, including material risks related to cybersecurity threats. This oversight may be executed directly by the Board of Directors or through its committees. The Board of Directors has delegated oversight of Risk Management to the Audit Committee of the Board of Directors. The Audit Committee engages in regular discussions with Management regarding the Company's risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include evaluating current trends, internal risk assessments, and risk management policies. Annually, a comprehensive report on the state of the Information Security Program, including cybersecurity risk management, is provided to the Board of Directors by the CRO and CISO. This report includes: Risk assessment results; Third- and fourth-party vendor oversight; Results of security monitoring and testing; Security incidents or violations (if applicable); Internal and external audit results.


text: The Information Security Program employs various information security controls, tools, and strategies to combat threats and to ensure the Company's information and systems remain secure. The Information Security Program contains specific provisions for identifying, assessing, and mitigating cyber threats, including but not limited to social engineering, credential theft, and vulnerability exploitation.


text: Due to the dynamic nature of risks, threats, vulnerabilities, and the information systems themselves, all information systems that store, process, or transmit sensitive and confidential information are protected by defense-in-depth strategies that include strong authentication techniques, firewalls, network security settings, end point protection, physical security measures, and security awareness training.


text: The Information Security Program is periodically reviewed to ensure that internal controls are designed appropriately and operating as expected. The Information Security Program is reviewed and approved by the Board of Directors annually. Periodic audits are performed by internal and external auditors to confirm adherence to the security program and regulatory guidelines and requirements. The Information Security team performs an annual assessment of cybersecurity risk and maturity using the FFIEC Cybersecurity Assessment Tool and reports the results to the Board of Directors as part of the annual report.


text: The Information Security Program complies with all applicable regulations, including Section 501(b) of the Gramm–Leach–Bliley Act and Section 216 of the Fair and Accurate Credit Transactions Act of 2003. The Information Security Program aligns with National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security (benchmarks for device hardening.


text: The Information Security team is responsible for monitoring and identifying all vulnerabilities and suspected threats and implementing corrective actions, if required. The Information Security team conducts risk assessments on the technology stack, determines effectiveness of internal controls, and develops remediation plans. The Information Security team utilizes specialized service providers to perform continuous monitoring, alerting and containment of potential threats, and penetration testing. The Information Security team maintains a Vendor Management Program and performs ongoing periodic risk assessments on third- and fourth-party vendors and their associated technologies, if applicable.


text: While extensive cybersecurity controls and procedures are in place, the risk of experiencing an incident can never be eliminated completely. We maintain and regularly review and update an Incident Response Plan designed to address adverse events that could impact the security of information, that affect our ability to conduct secure financial transactions, or that present reputational risk.


text: The Company has incorporated evaluation of cybersecurity threats into its overall risk management strategy. As such, Willdan has established a cybersecurity program designed to address applicable legal requirements. Through its internally dedicated cybersecurity team, combined with cybersecurity-specific technologies and external cybersecurity service professionals, the Company assesses, identifies, and manages material risks from cybersecurity threats to its critical computer networks, hardware and software, and data.

companyName: Willdan Group, Inc.

ticker: WLDN


text: The Company's cybersecurity team helps identify and assess risks from cybersecurity threats by monitoring and evaluating the Company's threat environment using various methods. Through the use of internal and external risk assessment audits of certain environments aimed at identifying potential areas of cybersecurity risk, external and internal monitoring alerts, and other external and internal tools (such as next generation endpoint security (EDR/XDR), SASE framework, next-gen firewalls, and external-party monitoring of endpoint and cloud security environments), the Company performs ongoing assessments of its cybersecurity risks that are designed to take into account the rapidly evolving cybersecurity threat landscape. Further, in conjunction with its ISO 27001 and SOC2 certifications, the Company undergoes annual external audits that include reviews of its cybersecurity risk assessment processes and policies.


text: In an attempt to manage and mitigate material risks from cybersecurity threats, the Company's cybersecurity risk management process includes certain preventive measures, detective controls, and incident response procedures, depending on the environment and systems. This includes implementing security controls in certain environments and systems, ongoing monitoring of certain environments and systems, adopting response protocols for security incidents, and maintaining cybersecurity insurance. The Company's cybersecurity risk management approach is periodically reviewed by management and certain external service professionals to assess whether any changes are needed to reflect changing threats.


text: In addition, assessment and management of material risks from cybersecurity threats are integrated into the Company's risk management strategy. For example, our cybersecurity team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, Cyber security breaches or other systems and information technology interruptions could result in liability, harm our reputation and impact our ability to operate.


text: The Company engages third-party cybersecurity consultants and auditors who help the cybersecurity team in identifying, assessing, and managing material risks from cybersecurity threats, including by evaluating and enhancing the Company's cybersecurity posture. The Company also engages third-party service providers to perform a variety of functions throughout its business. The Company performs due diligence before engaging with certain third-party service providers designed to evaluate the service providers' cybersecurity practices, including their security policies, incident response capabilities, and data protection measures (as evidenced by third party certifications including ISO 27001 and SOC II reports); including specific cybersecurity requirements in contracts with certain third-party service providers, such as regarding security standards, data protection, and incident reporting as applicable; and monitoring and auditing certain third-party service providers' cybersecurity practices and compliance with contractual obligations. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, the Company's vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: The Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the certain members of Company management, including those who are part of the Company's cybersecurity team. The Company's cybersecurity team is comprised of individuals with expertise in cybersecurity, information technology, risk management, and Company operations. Our cybersecurity team has decades-long experience in cybersecurity and holds industry-standard certifications including Certified Information Systems Security Professional ("CISSP"), Certified Cloud Security Professional ("CCSP"), among others.


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The Company's cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel (collectively, "Executive Management"). Executive Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Board for certain cybersecurity incidents.


text: The Company's Board provides oversight of cybersecurity risk and regularly receives updates from the Company's cybersecurity team. These updates cover topics that include cybersecurity team member updates, cybersecurity infrastructure updates, improvement in cyber-security tools and technologies, cybersecurity framework compliance, cyber-risk hardware/software enhancement updates, cybersecurity threats and mitigation measures, and more. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various industry standard security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Given the prevalence of social engineering attacks, we have implemented a two-pronged approach of training and security mitigations: educating users about how to detect a potential attack (phishing, malware, etc.) and security tools, which can decrease the likelihood of occurrence through multi-factor authentication, endpoint detection and response and other tools focused on locking down cyber threats. A team of industry experts comprised of representatives from our Information Technology department and support functions, along with outside experts assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Executive Leadership Team and Audit Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors. These mitigations target implementing automated tools for detection and prevention wherever possible, supplemented by training and process controls as needed. Recurring maintenance, reporting and awareness tasks are conducted and documented within our Service Management Software and Security tools for record keeping and trending.

companyName: Neuronetics, Inc.

ticker: STIM


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes through various penetration testing and best practice reviews. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We are aware that cybersecurity is a continually changing landscape and as a result, the engagement with these experts helps us evaluate our risk-based processes with respect to the trends.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "Security and privacy breaches may expose us to liability and harm our reputation and business " in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of emerging industry-wide trends in cybersecurity risks along with specific risk areas our company has greater risks throughout the year, including, among others, those relating to cybersecurity threats. These reports come from the Head of IT to include our enterprise risk profile on a quarterly basis. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are industry-standard metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Head of IT is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Head of IT has over 20 years of experience in information security and possesses the requisite education, skills and experience expected of an individual assigned to these duties. In addition to individual skills, the Head of IT has partnered with several third-party Cybersecurity experts to identify new areas of risk and the latest trends in security tools and methods.


text: Cybersecurity Risk Management and Strategy AerSale has developed and implemented a comprehensive cybersecurity risk management program for identifying, assessing, and managing material risks to protect the confidentiality, integrity and availability of critical systems and information relevant to our business. Our program utilizes a risk-based approach and is designed based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST"), and the Center for Internet Security ("CIS"), and shares common methodologies, reporting channels, and governance processes that apply across all areas of our enterprise risk management, including legal, compliance, operational, and financial risks.

companyName: AerSale Corp

ticker: ASLE


text: AerSale's comprehensive cybersecurity risk management program includes, among others: a security awareness training agenda with topics relating to phishing, spams, viruses, insider threats, suspicious activity and procedures to escalate them, as well as other safety concerns. Certain training programs are employee targeted based on their individual job responsibilities and on the potential risks associated with such roles.


text: internal and external assessments, including audits and response simulations, to examine cybersecurity vulnerabilities and potential attack vectors to company systems, as well as evaluating the impact of these vulnerabilities in our operational and financial posture.


text: processes to identify and respond to material cybersecurity risks from third party service providers, and risk mitigation policies to reduce exposure to such risks. a cybersecurity incident response plan that includes procedures for responding to cybersecurity threats or incidents.


text: when appropriate, use of external subject matter specialists, including assessors, consultants, auditors or other third parties, to provide incident response services and to conduct independent assessments of internal response readiness. engagement in security practices that include physical, administrative and technical safeguards of systems and hardware.


text: We are not aware of any risks from cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to AerSale's Business and Industry—Our business could be negatively affected by cyber or other security threats or other disruptions" in "Risk Factors" on page 13 of this Form 10-K.


text: Our Board of Directors has overall responsibility for risk oversight, and has delegated the responsibility of cybersecurity and other information technology related risks to the Audit Committee of the Board of Directors, which oversees the implementation and continuous improvement of our comprehensive cybersecurity risk management program and compliance with disclosure requirements. The Audit Committee is provided with information, results of internal and external assessments, and updates on cybersecurity initiatives at Audit Committee meetings from our Chief Information Officer, and is responsible for reporting any findings and recommendations to the Board of Directors for consideration. Our team of cybersecurity professionals is led by our Chief Information Officer, a seasoned technology executive with over 20 years of experience in the cybersecurity field, a strong focus on systems and security, and a proven track record of leading cyber experts to protect organization from evolving threats. The cybersecurity team has the primary responsibility for AerSale's comprehensive cybersecurity risk management program, and supervises internal personnel as well as external cybersecurity consultants. Our processes are designed to prevent and monitor cybersecurity incidents, allowing us to timely detect and respond to incidents through our cybersecurity response plan, which includes materiality evaluations based on the size and scope of the incident. This evaluation is documented in an incident report that is shared with the Chief Information Officer, Chief Financial Officer and Audit Committee to effectively manage resources to reduce risk and prevent future incidents.


text: We evaluate our cybersecurity strategy annually, including our processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein, within our overall enterprise risk management framework. Our cybersecurity strategy takes a multi-faceted approach, one which focuses on the following key areas: (i) the human element within the organization; (ii) perimeter security; (iii) network security; (iv) application security; (v) endpoint security; and (vi) data security. We use a wide array of processes, mechanisms, controls, technologies, systems, strategies and tools in each of these areas, including but not limited to: routine security awareness training, formal evaluations of third-party applications, password strength policies, antivirus software, firewalls, routine patch management, encryption software, data backups and data redundancies, email security software, multi-factor authentication tools, network security monitoring, and web vulnerability scanning.

companyName: XOMA Royalty Corp

ticker: XOMA


text: We engage outside consultants on a regular basis to help us design internal controls and processes to address cybersecurity risks. We also leverage these outside consultants and other third parties, when appropriate, to implement appropriate processes, policies, and internal controls designed to help prevent, detect, and/or mitigate these cyberthreats.


text: In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. These threats include but are not limited to: (i) ransomware and malware attacks; (ii) endpoint attacks; (iii) compromised business email and other social engineering threats; and (iv) vulnerabilities related to inadequate patch management. Our licensees, suppliers, contractors, and consultants also face similar cybersecurity risks, which could have an adverse impact on our business. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the headings "If our information technology systems or data or those of our partners or contractors are compromised, our business could experience adverse consequences, including regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; and loss of revenue or profits" and "Compliance with the stringent and changing obligations related to data privacy and security is an onerous and resource-intensive process. Our actual or perceived failure to comply with any data privacy or security obligations could lead to regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences."


text: Our management, led by our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer, is responsible for assessing cybersecurity risks and for confirming we have an appropriate cybersecurity strategy to assess and manage those risks, including responding to attacks or breaches. Our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer each have experience in senior leadership roles in which they have been responsible for the entity's enterprise risk management, including management of cybersecurity risks. The Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer meet regularly with the individuals charged with the day-to-day IT operations and infrastructure, and at least quarterly to review and assess potential cybersecurity threats to determine whether any changes need to be made to our cybersecurity strategy. The Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer sponsor periodic cybersecurity awareness training for all employees.


text: We also maintain an Incident Response Plan that sets forth a protocol in the event we are exposed to a cyber-attack or breach. The Incident Response Plan provides a framework for our response, including the appropriate communication and escalation channels.


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee of the Board, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. Management provides regular updates to the Audit Committee of the Board regarding risk assessments, developing threats, and the current and planned cybersecurity strategy, and promptly provides notification of significant attacks or breaches as part of the Incident Response Plan. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical comp uter networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: The cybersecurity function within the Company helps identify, assess and manage the Company's cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response, data encryption, network security controls, system monitoring, penetration testing, employee training, a dedicated cybersecurity staff member, and physical security mechanisms.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We manage cybersecurity risks associated with our use of these providers by reviewing their security assessments and applicable reports.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: Confidentiality agreements with employees and third-parties may not prevent unauthorized disclosure of trade secrets and other proprietary information;


text: The adoption and deployment of AI in our, and any third-party collaborators' operations, and in particular our and any third-party collaborators' R&D efforts to explore new targets and develop effective products, may not be effective and may expose us to risk;


text: If our information technology systems or data, or those of third-parties upon which we rely, are or were compromised or experienced significant disruptions of our information technology systems or data security incidents, we could experience adverse consequences including but not limited to significant financial, legal, regulatory, business and reputational harm; litigation; fines and penalties;


text: disruptions of our business operations; loss of revenue or profits; loss of customers or sales; or other adverse consequences; and We rely on trade secret and proprietary know-how which can be difficult to trace and enforce and, if we are unable to protect the confidentiality of our trade secrets, our business and competitive position would be harmed.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Internal Controls and SOX Compliance, who has over 20 years in the areas of internal controls and SOX compliance reporting; our Director of IT Security and Compliance, who has over 20 years of IT experience, the past four of which have been in security; and our CFO, who has over 20 years of business development experience.


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO and cybersecurity function are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the CFO. Our CFO and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from our cybersecurity function concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition..


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Ares, the parent company of our Advisor. Ares' cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Ares' enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Ares' cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Ares has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: Ares' cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Ares prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor or Ares. Ares' cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Advisor or Ares, is integrated into Ares' Enterprise Risk Management program, which is overseen by the Ares Enterprise Risk Committee (the "Ares ERC"), as discussed below. In addition, Ares periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.


text: The Ares cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training, including for all of the employees of Ares. Ares' cybersecurity training programs also include annual certification requirements for employees of Ares with respect to certain policies supporting the cybersecurity program including the Information Security and Electronic Communications policy, Data Protection policy and Privacy Policy. Ares undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of Ares' and our critical third-party vendors and other partners. Ares also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In the event of a cybersecurity incident impacting us, our Advisor or Ares, Ares has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Ares, including coordinating with the relevant members of our Advisor. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Ares' Chief Information Security Officer ("CISO"), and, as appropriate, escalation to the full Ares ERC and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Ares, as well as to the audit committee of our board of directors and to our full board of directors, if appropriate.


text: Material Impact of Cybersecurity Risks In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by Ares' dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Ares' CISO who has a Master's degree in Cybersecurity from Brown University and over 25 years of experience advising on, and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Ares CISO is also a member of the Ares ERC. The Ares ERC is a cross-functional committee that governs and oversees the Ares Enterprise Risk Program, including cybersecurity. The Ares ERC includes members of Ares' senior executive management, including its CEO, CFO, General Counsel, Global Chief Compliance Officer, Chief Information Officer, CISO, and Head of Enterprise Risk, who acts as chairperson of the Ares ERC. The Ares ERC, through regular consultation with the Ares internal cybersecurity team and representatives from our Advisor, assesses, discusses, and prioritizes Ares' approach to high-level risks, mitigative controls, and ongoing cybersecurity efforts.


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Certain members of the Ares ERC periodically report to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Director of Information Technology on the status of our cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: 908 Devices Inc.

ticker: MASS


text: Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer). Currently, the Director of Information Technology role is held by an individual who has approximately 19 years of information technology experience and 10 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Director of Information Technology and up to the Chief Product Officer and other members of executive management, where appropriate.


text: We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process, supported by security testing, that is designed to address the treatment of identified security risks based on severity.


text: As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of major third-party vendors and service providers that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems, including through review of applicable certifications, and security reports, and contractual requirements, as appropriate.


text: We have implemented a process to periodically conduct security awareness training for employees and simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.


text: Our Director of Information Technology and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use various internal and external processes and technologies, including third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We have adopted an incident response plan to guide us in responding to cybersecurity incidents and maintain processes to inform and update executive management and the audit committee about security incidents that may pose a significant risk for our business, as applicable.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.


text: The Company relies extensively on various information systems and other electronic resources to operate its business. In addition, nearly all of the Company's customers, service providers and other business partners on whom the Company depends, including the providers of the Company's online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of the Company's business, as a financial services provider, and the Company's relative size, make the Company and its business partners high-value targets for these bad actors to pursue. See "Item 1A. RISK FACTORS—Operational, Strategic and Reputational Risks".

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Accordingly, the Company has devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, as noted below:


text: Identifying and assessing cybersecurity threats: The Company regularly evaluates its systems and data for potential vulnerabilities and analyzes the evolving cyber threat landscape, to ensure it proactively addresses risks before they materialize. The Company employs monitoring tools that can detect and help respond to cybersecurity threats in real-time.


text: Cybersecurity risks are seamlessly integrated into the Company's broader risk management framework, ensuring a holistic view and prioritized mitigation strategies.


text: Management of Third-Party Risk: The Company's comprehensive third-party management process includes rigorous due diligence, oversight and identification of cybersecurity risks associated with vendors and service providers.


text: The Company has an internal cybersecurity team that is responsible for conducting regular assessments of its information systems, existing controls, vulnerabilities and potential improvements.


text: The Company leverages the expertise of independent consultants, legal advisors, and audit firms to evaluate the effectiveness of our risk management systems and address potential cybersecurity incidents efficiently. Training: The Company conducts periodic cybersecurity training for its workforce.


text: This information security program is a key part of the Company's overall risk management system, which is administered by the Director of Information Security. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of the Company's businesses and geographic locations.


text: From time-to-time, the Company has identified cybersecurity threats and cybersecurity incidents that require the Company to make changes to its processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected the Company, it is possible that threats and incidents the Company identifies in the future could have a material adverse effect on its business strategy, results of operations and financial condition.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks it faces, including the Company's Executive Vice President and Chief Technology Officer and Director of Information Security. The Company's current Director of Information Security has over 28 years of experience. For the past 7 years, the Company's Director of Information Security has successfully managed teams, implementing and maintaining robust cybersecurity and data protection controls to safeguard the Company's information assets. The Company's Director of Information Security reports directly to our Executive Vice President and Chief Technology Officer, who possesses extensive expertise gained through over 39 years in various IT and leadership roles. This combined experience ensures exceptional guidance and oversight of our cybersecurity program.


text: In addition, the Company's Board of Directors, both as a whole and through its Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Company's Board of Directors and the Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both the Company's Board of Directors and the Risk Committee receive quarterly reports from the Company's management team regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: ISG maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and the Company's client-facing products. We regularly assess the threat landscape, taking a holistic view of cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: Information Services Group Inc.

ticker: III


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology. ISG performs annual assessments, by two independent third parties, against the International Organization Standardization ("ISO") 27001 Information Security Management System requirements for which we maintain certification. ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials, and is preparing for SOC2 attestation across our GovernX platforms.


text: The Company's cybersecurity efforts are led by the Chief Information Security Officer ("CISO"), who reports to the Chief Information Officer ("CIO") and has responsibilities that cover the management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has proven cyber operations and cyber risk management experience, having previously worked for UK law enforcement and leading organizations in the financial services, health and advertising sectors. Our CISO also holds relevant cyber management qualifications, such as being a Certified Information Systems Security Professional. The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cyber security disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents. Cybersecurity risk is maintained and managed under our Information Security Management System framework with oversight through our internal Executive Board ("IEB") and our Board of Directors, which has delegated responsibility for cybersecurity risk to our Information Security Committee ("ISC").


text: Cybersecurity is an important area of focus for our Board of Directors. The Board of Directors reviews and discusses with our CIO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, any significant cybersecurity incidents and the emerging threat landscape. Our CIO discusses the same cybersecurity topics covered with the Board of Directors with the IEB. In addition, the IEB makes decisions on resourcing and project prioritization in support of our cybersecurity and compliance initiatives.


text: Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely the Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager. The ISC oversees the management of processes for identifying and mitigating cybersecurity risks, material vulnerabilities and high rated incidents, to help align our risk exposure with our strategic objectives. The ISC meets quarterly and receives additional ad-hoc briefings from the CISO as and when required.


text: In the event of a major security incident, certain members of the ISC form part of our Incident Management Team ("IMT"). The IMT follows our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership, the IEB and the Board of Directors, as appropriate.


text: For the evaluation of our security controls, ISG engages third-parties services to conduct penetration testing, independent audits or provide consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of our security controls. We also share and receive threat intelligence which we utilize to bolster defenses against active threats. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across the security domain.


text: ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network. We maintain processes and procedures to continuously assess third-party cybersecurity risk and include security and privacy addendums to our contracts where applicable. We seek to work directly with any suppliers to address potential deficiencies when identified.


text: To mitigate the risk and negative exposure of personal data being breached or inadvertently shared outside of ISG, we maintain a data protection framework that includes policies, procedures, guidance and records. This includes policies and procedures regarding the rights and usage of personal and client data. ISG employs a Data Privacy Manager who briefs the ISC on privacy matters as part of the quarterly ISC meetings. The Data Privacy Manager completes an internal audit annually and works with a specialist third party to complete an external Data Protection Compliance review.


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating cybersecurity threats or incidents, and such threats or incidents may have a material adverse effect on us. While ISG maintains cybersecurity insurance, the costs related to cybersecurity threats or service disruptions to both ISG and our clients may not be fully insured. For more information regarding the risks we face from cybersecurity threats, see the risks identified under "Risks Related to Data, Cybersecurity and Confidential Information" found in "Part 1A, Risk Factors" of this Annual Report on Form 10-K.


text: Our cybersecurity program provides what we believe is an effective level of protection of client information and of our operating systems while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we invest heavily in up-to-date information security and monitoring controls, which we believe provide the best mechanism to mitigate cybersecurity risks and threats. At the same time, cyberattacks are becoming increasingly common, sophisticated and destructive, and several highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. In order to mitigate these risks and the potential harm that may result, our Chief Information Security Officer, who reports directly to the Chief Information Officer and who reports regularly to our Board's Audit Committee, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. We also maintain and periodically review our cybersecurity disclosure procedures to assure the timely compliance with the Company's obligations under Item 1.05 of Form 8-K.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our Company's Corporate Security Handbook and Information Security Program are the guiding policies over our cybersecurity risk management. Additionally, our IT team uses industry-leading tools to help protect stakeholders against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our Company team members are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.


text: Engaging Third Parties for Risk Management We recognize the complexity and evolving nature of cybersecurity threats, which is why we engage a range of external experts, including cybersecurity consultants, in evaluating and testing our risk management systems. Our IT security team partners with third-parties to perform annual penetration testing, vulnerability scanning, and monitoring of any potentially suspicious activity across the Company.


text: Oversight of Third-party Risk The Company's Third-Party Relationship Risk Management ("TPRM") Policy governs of all aspects of third-party risk management. The Board has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to the Audit Committee and management regarding the Company's strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews the TPRM Policy on at least an annual basis and ensures that appropriate implementation procedures and practices have been established by management. The Chief Risk Officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Company's strategic goals, risk appetite and the level of risk and complexity of its third-party relationships. The Chief Risk Officer periodically provides reports to the Audit Committee on third-party risk management activities. The Company's Internal Audit department determines the frequency and scope of independent third-party audits of the TPRM program and its effectiveness.


text: The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management. As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity risks or threats that have materially impaired our business strategy, results of operations, or financial condition.


text: The Board recognizes the importance of managing risks associated with cybersecurity threats. The Board has established robust oversight procedures to promote effective governance in managing cybersecurity risks because of the significance of these threats to our operational integrity and shareholder confidence.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks. The Audit Committee currently oversees risks relating to cybersecurity, technology, and finance, and in support of this objective has designated an ad hoc committee consisting of both Committee members and non-Committee member directors so as to assure that the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The Audit Committee reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include cybersecurity and related risks and our exposure to those risks. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with its overall risk management framework.


text: The Chief Information Security Officer plays a pivotal role in informing the Audit Committee on cybersecurity risks. He reports quarterly to the Audit Committee on a range of topics, including: Current cybersecurity landscape and risks; Status of ongoing cybersecurity incidents, threats and strategies; Cybersecurity incident reporting and post-incident reviews; and Compliance with regulatory requirements and evolving industry trends.


text: The Chief Information Security Officer reports to the Chief Information Officer, has a dotted line to the Chief Executive Officer, and maintains independence in reporting on the status and impact of any information security related developments and strategic initiatives to the Audit Committee, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the Audit Committee, Chief Information Security Officer, Chief Information Officer, Chief Risk Officer and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Company's internal Risk Management Steering Committee also reports directly to the Audit Committee regarding our risk management initiatives. The Audit Committee also receives quarterly reports from the Risk Management Steering Committee, the Company's Internal Audit department, and IT department in order to say informed on all aspects of cybersecurity risk affecting the Company.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer, who has more than 20 years of cybersecurity experience working with large financial institutions and actively maintains multiple information security certifications. Additionally, our Chief Information Security Officer oversees our cybersecurity incident disclosure and communications. Our Chief Risk Officer separately chairs our Risk Management Steering Committee. Our Chief Risk Officer has served in her position since 2014 and is an accomplished banking professional with more than 40 years of experience in compliance and risk management.


text: Monitoring Cybersecurity Incidents The Company monitors cybersecurity events using multiple methods. The Company's 24/7 Security Operations Center ("SOC") has the ability to detect and respond to threats in real time and is authorized to shut threats down before they can harm the organization. Additionally, the SOC periodically performs pro-active "threat hunts," searching for potential indicators of compromise and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The Chief Information Security Officer is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat is immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The Chief Information Security Officer may determine that an incident has the potential to be materially relevant and would escalate that determination to the Cybersecurity Incident Disclosure Team comprised of the senior leaders, including the Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, outside counsel and other leaders and advisors of the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.


text: Reporting to Board of Directors The Chief Information Security Officer, in his capacity as such, regularly reports to management and the Audit Committee on all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face. In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence to the best of our ability. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans and penetration tests.

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, research, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, future lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, and harm to our vendor relationships. The company is currently in the process of implementing a more formalized cybersecurity program.


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data, and we maintain a cybersecurity risk management program as a part of our overall risk management program that is focused on identifying, assessing and managing cybersecurity risk. Key elements of that program include: Alignment with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyberattacks; Engaging external cybersecurity experts in incident response development and management;

companyName: ELUTIA INC.

ticker: ELUT


text: An information security training program instructing company employees with access to our networks how to be aware of, and help defend against cybersecurity risks; Evaluating the cybersecurity risk of third party service providers; and Business continuity plans and critical recovery backup systems.


text: Our cybersecurity risk management program is supervised by our Director of Information Systems whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes, as well as managing the Company's information security and risk management awareness program.


text: Cybersecurity Incident Response Process We maintain and regularly update a cybersecurity incident response plan that outlines the steps we take to identify, investigate and take action in response to any potentially material cybersecurity incidents. Our incident response plan is designed to ensure that our Director of Information Systems and members of our senior management team are timely informed of and consulted with respect to any potentially material cybersecurity incidents.


text: Board Oversight of Cyber Risk Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, which provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. Periodic updates are provided to the Audit Committee on, among other things, our cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. We also engage third parties to periodically evaluate and audit aspects of our information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.