text: We have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to ensure the availability of critical data and systems. The information security management system supporting our online learning platform has been independently certified to the International Organization for Standardization ("ISO") / International Electrotechnical Commission 27001:2013 standard. This standard is designed to promote risk management, cyber-resilience, and operational excellence with respect to an information security management system. Our online learning platform undergoes regular internal security testing, and we engage third-party providers to perform penetration and vulnerability tests. We have annual independent third-party audits conducted on system security and availability, such as Systems and Organization Controls 2 Type 2 ("SOC 2") audit reports and ISO 27001 certification. Certain highly sensitive information, such as personally identifiable information ("PII") about our learners in our online learning platform, is encrypted at rest and in transit using industry standards. We also require employees and contractors to undergo information security awareness training. In addition, to mitigate the financial impact of cybersecurity incidents, we maintain insurance to help cover losses resulting from such potential incidents.


text: We maintain a risk-based approach to identify and oversee cybersecurity risks, including risks presented by authorized service providers who have access to our systems or information. We have processes in place to assess and manage associated cybersecurity risks, which include conducting due diligence on the cybersecurity profile of the third party provider and, in cases where PII is shared, ongoing cybersecurity and privacy obligations that are documented in data processing agreements. Our online learning platform is hosted by major cloud-hosting providers, and we require such providers and other third parties that have access to PII or certain other highly sensitive data to be independently SOC 2 attested and/or ISO 27001 certified to ensure that such service providers conform to our security standards.

companyName: Coursera, Inc.

ticker: COUR

secItem: Item 1C


text: Our board of directors (the "Board") is responsible for monitoring and assessing strategic risk exposure, and our audit committee has been designated with the responsibility of overseeing our technology and information security, including cybersecurity, policies and practices, and the internal controls regarding information security. Our Senior Vice President of Engineering provides quarterly updates to the audit committee on these topics, as well as cybersecurity risk exposure and steps taken to monitor and mitigate such exposure. The Board receives reports from management on our information security and cybersecurity matters on an annual basis. In addition, our incident response process provides that our audit committee is notified in the event of a material cybersecurity incident.


text: Notwithstanding the foregoing efforts, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. Like many other businesses, we have experienced, and are continually subject to, cyberattacks. While these past cyberattacks have not materially affected us or, in our belief, are not reasonably likely to materially affect us, future cybersecurity incidents and threats may materially affect our business strategy, results of operations, or financial condition. For more information regarding our cybersecurity related risks, refer to our risk factors included in Part I, Item 1A of this Form 10-K.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. To this end, we maintain an information security program designed to protect our information, intellectual property, and systems, including the data we host and maintain for our learners, customers, and partners in accordance with industry standards and best practices.


text: Our information security team is led by our Senior Vice President, Chief Technology Officer ("CTO") and our Vice President, Information Security, who together have over 36 years of technology industry experience and expertise in information security, cybersecurity, and distributed systems. This team is responsible for our information security program and protocols, including managing and coordinating efforts to prevent, mitigate, detect, and remediate cybersecurity incidents, and escalating significant security risks or incidents to executive management.


text: We have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to ensure the availability of critical data and systems. The information security management system supporting our online learning platform has been independently certified to the International Organization for Standardization ("ISO") / International Electrotechnical Commission 27001:2013 standard. This standard is designed to promote risk management, cyber-resilience, and operational excellence with respect to an information security management system. Our online learning platform undergoes regular internal security testing, and we engage third-party providers to perform penetration and vulnerability tests. We have annual independent third-party audits conducted on system security and availability, such as Systems and Organization Controls 2 Type 2 ("SOC 2") audit reports and ISO 27001 certification. Certain highly sensitive information, such as personally identifiable information ("PII") about our learners in our online learning platform, is encrypted at rest and in transit using industry standards. We also require employees and contractors to undergo annual information security awareness training. In addition, to mitigate the financial impact of cybersecurity incidents, we maintain insurance to help cover losses resulting from such potential incidents.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our audit committee has been designated with the responsibility of overseeing our technology and information security, including cybersecurity, policies and practices, and the internal controls regarding information security. Our CTO provides quarterly updates to the audit committee on these topics, as well as cybersecurity risk exposure and steps taken to monitor and mitigate such exposure. The board of directors receives reports from management on our information security and cybersecurity matters on an annual basis. In addition, our incident response process provides that our audit committee is notified in the event of a material cybersecurity incident.


text: We recognize the critical importance of maintaining the trust and confidence of customers, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: DermTech, Inc.


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee of our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Information Security Officer, General Counsel, Chief Compliance Officer and Chief Information Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST and Center for Internet Security (or "CIS") as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle confidential information, personal data and other sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage incident handling frameworks to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; • use a third-party risk management platform to continually assess and manage risk, using CIS and NIST benchmarks, HIPAA security rules and guidance and overall information technology risk; • use a third-party service providers to continuously monitor, perform vulnerability scanning, and penetration testing of our internal and/or external online presence, including wireless networks, cloud-based servers, business website, and electronic communications; • utilize defined onboarding and monitoring procedures with third-party contractors, including risk- based surveys as part of the vendor management and selection process; and • establish a cross-functional governance working group or committee led by the Information Security Officer to oversee and make recommendations as to data classification, management and access.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annual review of our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity incidents, cyberattacks and other information technology failures could result in loss of data, compromise of confidential information, and adverse effects to our business, financial results and our ability to continue operations," which disclosures are incorporated herein by reference. In the last three fiscal years, we have not experienced any material cybersecurity incidents.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. In general, the audit committee oversees risk management activities designed and implemented by our management.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity scorecard / dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Information Security Officer. Our audit committee also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee and board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Information Security Officer, Chief Information Officer, Chief Privacy Officer, Chief Financial Officer, Chief Compliance Officer and General Counsel. Such individuals have collectively over approximately 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Privacy Manager, and Certified Information Systems Security Professional. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis and annually.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Vice President of Privacy, Safety, and Security Engineering. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Alphabet Inc.

ticker: GOOGL


text: As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across Alphabet, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our Alphabet Inc.


text: Alphabet Inc. senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Alphabet's independent public accounting firm of matters and any relevant developments.


text: The Audit and Compliance Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit and Compliance Committee. Internal Audit maintains a dedicated cybersecurity auditing team that independently tests our cybersecurity controls.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. For example, some risks include our software supply chain and other third-party dependencies, vulnerabilities in our products and services, theft of our intellectual property, and attempts to compromise our infrastructure. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal threat intelligence teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. These teams comprise professionals with deep cybersecurity expertise across multiple industries and are led by our Vice President of Privacy, Safety, and Security Engineering, who has 20 years of experience, including roles in technology infrastructure for two other large public companies. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.


text: As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across Alphabet, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is promptly escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior Alphabet Inc.


text: Alphabet Inc. management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Alphabet's independent public accounting firm of matters and any relevant developments.


text: At Ingevity, we recognize the paramount importance of cybersecurity in safeguarding sensitive information. We are aligned with industry standards, such as the ISO 27001 cybersecurity framework. Our comprehensive cybersecurity program is led by a team of diverse, highly skilled professionals, and we invest in modern technologies, including artificial intelligence and machine learning, to fortify our defenses. We continue to collaborate with local, state and federal agencies and peers in the chemical manufacturing industry to identify the latest threats and implement effective defenses to protect our employees and customers.

companyName: Ingevity Corp

ticker: NGVT


text: Leadership and Governance. Led by our Chief Information Security Officer ("CISO"), we have a team of skilled internal and external cybersecurity professionals. Our Board of Directors ("the Board") has oversight of our cybersecurity and risk management programs. The Board receives at least semiannual updates from the Chief Information Officer and CISO on cybersecurity matters and our risk management program, and periodic updates from external cybersecurity experts on the overall risk landscape. We have implemented processes for continual monitoring of our information systems, including the deployment of advanced security measures and system audits to identify potential vulnerabilities. If a cybersecurity incident were to occur, we are equipped with an incident response plan that includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Additionally, our cybersecurity team regularly meets with our executive management leadership team to provide updates on our cybersecurity risks and incidents ensuring management is keenly aware of any potential threat.


text: We maintain collection, storage, and access controls of personal, proprietary, and confidential information, focusing on protecting trade secrets, intellectual property, clinical trial data, third-party information, and employee data.


text: Industry-Standard Frameworks and Policies. We incorporate industry-standard frameworks, policies, and practices such as ISO 27001 which are designed to protect the confidentiality and privacy of information.


text: Protection Mechanisms. We currently follow the ISO 27001 cybersecurity framework and are progressing toward program certification. We continuously monitor our enterprise network and have deployed detective and preventative controls. In-depth third-party security assessments are conducted annually.


text: Incident Response and Testing. We have a robust cybersecurity incident response plan that incorporates regular simulations, drills, and vulnerability scans, penetration testing and third-party assessments of our cybersecurity controls and resilience.


text: Third-Party Monitoring. We employ a managed security services provider that provides 24/7 monitoring of our enterprise network. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Insurance Coverage. We maintain insurance coverage that includes cybersecurity protection.


text: Our proactive approach to cybersecurity involves the integration of leading technologies and collaboration with third-party experts to ensure alignment with industry standards. We believe these measures contribute to the protection of both our organization's and our clients' sensitive information.


text: During the past year, there have been no material risks from cybersecurity threats or prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our security architecture and controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or intentional employee actions, system failures, and other risks that could materially impact our financial results and our results of operations.


text: At Ingevity, we recognize the paramount importance of cybersecurity in safeguarding sensitive information. We align with industry standards, including the ISO 27001 information security framework, for which we became certified in 2024. Our comprehensive cybersecurity program is led by a team of diverse, highly skilled professionals, and we invest in modern technologies, including artificial intelligence and machine learning, to fortify our defenses. We actively collaborate with local, state and federal agencies, as well as peers in the chemical manufacturing industry to identify the latest threats and implement effective defenses that safeguard our employees and customers.


text: We have a team of skilled internal and external cybersecurity professionals, led by our Vice President of Information Technology, Chief Information Officer and Chief Information Security Officer ("CIO"), who has over three decades of experience in information security and information technology infrastructure. Our team has experience in information security and information technology infrastructure and holds several advanced and expert licenses and certifications, including International Society of Automation 62443, Cybersecurity Expert and International Information System Security Certification Consortium (ISC2), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP). Beginning in 2025, the Sustainability & Safety Committee of our Board of Directors ("the Board") has oversight of our cybersecurity and risk management programs. Prior to that, the full Board exercised oversight of cybersecurity risk management. The Board moved oversight of cybersecurity risk management into the Sustainability & Safety Committee to allow for more in-depth reviews. The Sustainability & Safety Committee receives at least quarterly updates from the CIO on cybersecurity matters and our related risk management program, and periodic updates from external cybersecurity experts on the overall risk landscape. Our full Board of Directors also receives an update at least once a year on these matters in addition to regular reporting from the Sustainability & Safety Committee on matters reviewed. We have implemented processes for continual monitoring of our information systems, including the deployment of advanced security measures and system audits to identify potential vulnerabilities. If a cybersecurity incident were to occur, we have developed and documented an incident response plan that includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Additionally, our CIO regularly meets with our executive management leadership team to provide updates on our cybersecurity risks and incidents ensuring management is keenly aware of any potential threat.


text: We enforce collection, storage, and access controls of personal, proprietary, and confidential information, focusing on protecting trade secrets, intellectual property, clinical trial data, third-party information, and employee data.


text: Protection Mechanisms. We currently adhere to the ISO 27001 information security framework and are advancing our program having achieved ISO 27001 certification in 2024. We continuously monitor our enterprise network and have deployed detective and preventative controls. In-depth third-party security assessments are conducted annually.


text: Incident Response and Testing. We maintain a robust cybersecurity incident response plan that incorporates regular simulations, drills, vulnerability scans, penetration testing and third-party assessments to evaluate and enhance our cybersecurity controls and resilience.


text: Third-Party Monitoring. We partner with a managed security services provider for 24/7 monitoring of our enterprise network. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity measures aligned with applicable legal standards and industry best practices.


text: During the past three years, there have been no material impacts from cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our security architecture and controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or intentional employee actions, system failures, and other risks that could materially impact our financial results and our results of operations.


text: We recognize the importance of maintaining the trust and confidence of the customers we serve, our business partners, employees and our stockholders and are committed to protecting the confidentiality, integrity and reliance of our business operations and systems. Effective data protection and cyber security practices, including responsible stewardship of our intellectual property and the secure processing, storage, maintenance and transmission of critical information by us and other third parties with whom we do business is vital to our operations. We have adopted policies and procedures with an intended design to identify, assess and manage risks associated with cybersecurity threats.

companyName: Priority Technology Holdings, Inc.

ticker: PRTH


text: • We perform risk assessments periodically at both an enterprise level and system level in addition to assessments performed by third parties; • Our information security team performs threat monitoring services; • Our Internal Audit function performs annual reviews of selected systems and applications to test certain controls; • Independent consultants and auditors evaluate selected systems and applications on an annual basis; • We perform risk assessments of third-party vendors and perform ongoing risk-based monitoring of those third parties; and • We maintain a business continuity plan for execution in the event of a cybersecurity incident.


text: We have not experienced any material cybersecurity incidents in the past calendar years and the expenses we have incurred from cybersecurity incidents during that time were immaterial. We have not identified risks from known cybersecurity threats that have materially affected us, including our operations, business strategy, results of operations or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees the Company's overall risk framework including management's implementation of our cybersecurity risk management program. The Board receives reports from the Chief Risk Officer on a regular basis on cybersecurity and information technology risk management.


text: Our Company's cybersecurity team, overseen by our Chief Information Security Officer ("CISO") is responsible for assessing and managing our risks from cybersecurity threats, including defining our security policy and furnishing related information for Board reporting. The CISO approves all security policies and oversees the identification, assessment, and management of security risks. The CISO regularly reports to management's SOX Committee which may elevate cybersecurity issues to the Board at any time.


text: We recognize the importance of maintaining the trust and confidence of the customers we serve, our business partners, employees and our shareholders and are committed to protecting the confidentiality, integrity and reliance of our business operations and systems. Effective data protection and cyber security practices, including responsible stewardship of our intellectual property and the secure processing, storage, maintenance and transmission of critical information by us and other third parties with whom we do business is vital to our operations. We have adopted policies and procedures with an intended design to identify, assess and manage risks associated with cybersecurity threats.


text: • We perform risk assessments periodically at both an enterprise level and system level in addition to assessments performed by third parties; • Our information security team performs threat monitoring services; • Our Internal Audit function performs annual reviews of selected systems and applications to test certain controls; • Independent consultants evaluate selected systems and applications on an annual basis; • We perform risk assessments of third-party vendors and perform ongoing risk-based monitoring of those third parties; and • We maintain a business continuity plan for execution in the event of a cybersecurity incident.


text: We rely on our technology infrastructure and information systems to operate our gaming and non-gaming facilities, interact with customers, employees, utilize our data, support and grow our customer base, and bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed systems and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. Our Board of Directors has direct oversight of our management of cybersecurity risks.


text: The Board of Directors receives an evaluation of cybersecurity risks, which includes detailed descriptions of the actions we have taken to accept, transfer, or mitigate these risks and an analysis of cybersecurity threats and incidents across the industry. The Board of Directors reviews the evaluation on an annual basis. Management will provide a comprehensive update to the Board of Directors on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant.


text: Our Chief Information Security Officer reporting to our Chief Information Officer as well as the Chief Financial Officer is a twenty four year industry veteran, with 10 years of business operations experience and 14 years of technology experience including six years directly in cybersecurity. The Chief Information Security Officer has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Board of Directors on a regular basis. These updates contain information such as key performance indicators, National Institute of Standards and Technology ("NIST") Cybersecurity Framework status, cybersecurity road map status, and current events and issues.


text: Our Director of Cyber Security reports to our Chief Information Security Officer as well as our Chief Information Officer and is responsible for the operation of our cybersecurity program. Our Director of Cyber Security has 30 years of combined information technology experience with ten of those years working in the cybersecurity field as both an engineer and a director.


text: We have adopted the NIST Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory monthly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats.


text: When we experience a cybersecurity incident, our Chief Information Security Officer or Chief Information Officer will inform our Senior Leadership and/or the Board of Directors, Computer Security Incident Response Team, which will then evaluate and assess the nature and materiality of the incident to the Company, in general, its information technology infrastructure and data integrity, and whether the cybersecurity incident should be reported to the Board of Directors in advance of or external to the next regular cybersecurity update. Once a cybersecurity incident is reported to the Board of Directors, the Board of Directors, with the input of the Chief Information Security Officer and Chief Information Officer, will determine how to address it.


text: We engage subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Chief Information Security Officer oversees and establishes the parameters of our engagement with these experts to ensure we obtain the supplement assistance needed in this area, if any.


text: If there is a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Security breaches of our systems may allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information. Though we take steps to ensure our products and/or software are secure, it is possible that a cybersecurity incident could result in the loss or compromise of critical data. If a guest alleges that a cybersecurity incident causes or contributes to a loss or compromise of critical data, whether or not caused by us, we could face harm to our reputation and financial condition and regulatory repercussions. A cybersecurity incident could materially harm our reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events. See Item 1A. Risk Factors— Business, Economic, Market and Operating Risks—Failure to maintain the integrity of our internal or customer data, including defending our information systems against hacking, security breaches, computer malware, cyber-attacks and similar technology exploitation risks, could have an adverse effect on our results of operations and cash flows, and/or subject us to costs, fines or lawsuits.


text: Our Chief Information Security Officer reporting to our Chief Information Officer as well as the Chief Financial Officer has 30 years of information technology experience with eleven of those years working in the cybersecurity field as both an engineer and a director. The Chief Information Security Officer has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Board of Directors on a regular basis. These updates contain information such as key performance indicators, National Institute of Standards and Technology ("NIST") Cybersecurity Framework status, cybersecurity road map status, and current events and issues.


text: If there is a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Security breaches of our systems may allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information. Though we take steps to ensure our products and/or software are secure, it is possible that a cybersecurity incident could result in the loss or compromise of critical data. If a guest alleges that a cybersecurity incident causes or contributes to a loss or compromise of critical data, whether or not caused by us, we could face harm to our reputation and financial condition and regulatory repercussions. A cybersecurity incident could materially harm our reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events. See Item 1A. Risk Factors— Business, Economic, Market and Operating Risks—Failure to maintain the integrity of our internal or customer data, including defending our information systems against hacking, security breaches, computer malware, cyberattacks and similar technology exploitation risks, could have an adverse effect on our results of operations and cash flows, and/or subject us to costs, fines or lawsuits.


text: Cyber Risk Management and Strategy We have developed and maintain an information security program designed to assess, identify, and manage risks from cybersecurity threats. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks and include a review of our information security controls to assess cybersecurity maturity compared to our peers and other highly regulated industries. The results of these assessments are reported to the board of directors as part of a cybersecurity update report conducted at least annually.

companyName: Deciphera Pharmaceuticals, Inc.


text: We also engage vendors to assist with enterprise managed detection and response, global security operations center, security information and event management, and enterprise vulnerability management. In addition, we have implemented a cybersecurity third party risk management process to assess mission and business critical third parties for cyber risks and to assist the business in making risk-informed technology product and services decisions. Our practice is to perform due diligence, including the completion of security questionnaires and risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.


text: We have adopted an Incident Response Management Procedure (the Procedure) that outlines the legal and governance processes for identifying and managing material risks to privacy and security. An incident response team is responsible for carrying out the Procedure and is led by our information & technology (I&T) department, and includes members from our legal and compliance, privacy, investor relations, finance, and quality departments. In addition, our enterprise information security program describes our capabilities and processes for the preparation, detection, analysis, containment, recovery, and reporting of incidents. We also manage and maintain business continuity and disaster recovery capabilities to help ensure the availability of business-critical technology resources during adverse conditions.


text: Related to Cybersecurity Risks Management is responsible for the day-to-day management of risks we face, while our board of directors, as a whole and through committees, has responsibility for the oversight of risk management. Our board of directors oversees the management of our risks from cybersecurity threats. In addition, the full board discusses with management our major risk exposures, their potential impact on us, and the steps we take to manage them.


text: Our Vice President of I&T is responsible for developing, implementing, and maintaining our cybersecurity risk management policies and procedures. The individual currently serving in the role of Vice President of I&T has over twenty-five years of experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within complex and international business verticals such as pharmaceutical/biotech, technology, financial services, and retail. The Vice President of I&T reports to our Chief Financial Officer, and provides periodic cybersecurity updates to our board on at least an annual basis. Our incident response process contemplates that the executive team will notify the board of a material cybersecurity incident.


text: Our cybersecurity steering committee (the Steering Committee) oversees technical matters regarding cybersecurity through periodic meetings and frequent communications. When formal meetings are held, attending committee members include representatives from the I&T, regulatory affairs, quality, finance, and legal and compliance departments. The Steering Committee has a charter that is reviewed internally to ensure it is aligned with our business strategy. As outlined in its charter, the Steering Committee has three key roles: (i) systems assurance: to oversee the establishment and maintenance of effective cybersecurity mechanisms throughout the Company; (ii) documentation: review of documented policies, standards, processes, and procedures that will have a direct or indirect impact on the security and privacy of our information; and (iii) management of information security risk: identify and manage significant cybersecurity risks across the Company, including escalating to our executive leadership team where appropriate.


text: We face considerable cybersecurity risk due to constant and relentless efforts by cybercriminals to exploit physical, human, and technological vulnerabilities in order to gain access and control of our networks, data, and intellectual property. Constantly evolving technology and the planning, methodologies, and strategies these attackers utilize to capitalize on vulnerabilities in systems put us at a disadvantage. Although, we have not encountered a cybersecurity threat or incident that resulted in a material impact on our business, operations or financial condition, there is no assurance that we will not experience such an event in the future. We are committed, however, to maintaining vigorous oversight of these risks.

companyName: ATRION CORP


text: We regularly review industry recommendations, best practices, and standards regarding cybersecurity and information technology. NIST (National Institute of Standards and Technology), CIS (Center for Internet Security) and CISA (Cybersecurity and Infrastructure Security Agency) are some of our primary resources for information. We seek to meet or exceed the standards of, and recommendations by, these organizations as well as those of our third-party technology vendors. We require in-depth annual cybersecurity training for all of our end users as well as refresher training throughout the year. We have processes in place to prevent, identify, manage, and mitigate any occurrence timely, and we engage an independent firm to perform annual assessments of our network security and infrastructure. In addition to our existing methods of detection, monitoring, and mitigation of cybersecurity threats and incidents, we implement new technologies, controls, and policies with the goal of protecting our business, employees, investors, customers, and suppliers.


text: Our Board of Directors and our Audit Committee oversee our Company-wide risk management, including cybersecurity risk. More specifically, our Audit Committee reviews with our management, at least annually, emerging cybersecurity developments and threats, the Company's risks relating to cybersecurity, including a review of the state of the Company's cybersecurity and the Company's strategy to mitigate cybersecurity risks. Our internal cybersecurity team consists of our Chief Financial Officer, our Director of Compliance, and our Information Technology department, which includes multiple security certified professionals. Each member of the team has assigned roles related to cybersecurity events. In the event of a cybersecurity attack, members of the cybersecurity team review records and details to determine the depth and materiality of the occurrence. Based on their analysis, appropriate disclosure of the event will be made.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants in evaluating and testing the Company's risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: Inuvo, Inc.

ticker: INUV


text: Board of Directors The audit committee of the Company's board of directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the Company's disclosure controls and procedures and the audit committee provides updates to the Company's board of directors at regular board meetings.


text: Under the oversight of the audit committee of the Company's board of directors, and as directed by the Company's Chief Executive Officer, the Company's Director of Information Technology (DIT) is primarily responsible for the assessment and management of material cybersecurity risks. The DIT has over 25 years of experience in information security, risk management, and compliance, has served essential security and audit roles at other organizations, is a member of InfraGard, and is a CISSP (Certified Information Systems Security Professional). The DIT is supported by members of senior management who provide cross-functional support for cybersecurity risk management and facilitate the response to any cybersecurity incidents.


text: The Company's DIT oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. The Company's DIT also coordinates with the Company's legal counsel and third parties, such as consultants, to assess and manage material risks from cybersecurity threats. The Company's DIT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.


text: The Company's Disclosure Committee, with the assistance of the DIT, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Company's Chief Executive Officer, President, Chief Financial Officer, General Counsel, and Senior Vice Presidents. The Company's DIT, or a delegate, informs the Disclosure Committee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes.


text: As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor beginning on page 8 of the section entitled "Item 1A. Risk Factors" in this Form 10-K.


text: As a technology vendor within hosted services segment, Crexendo understands the importance of cybersecurity and data privacy. To proactively protect against related threats, and to be fully prepared for timely and effective response in case of an incident, a comprehensive program has been put in place leveraging the following:

companyName: Crexendo, Inc.

ticker: CXDO


text: Crexendo has adopted System & Organizational Controls (SOC2) for the service organization responsible for Crexendo Hosted product and related corporate assets/entities. Implemented controls cover trust services criteria of security, availability, processing integrity, confidentiality, and privacy. Independent service auditors have been engaged to measure the efficacy of implemented controls.


text: Third party security advisors have been engaged to periodically execute internal and external vulnerability scans for deployed production and organizational assets to flag any known vulnerabilities within deployed third-party components including but not limited to operating systems, web server software, hypervisor software etc.


text: Similarly, penetration tests are conducted periodically to expose any vulnerabilities within the deployment environment and/or deployed software; including but not limited to open firewall ports beyond deployment design, use of ciphers deemed insecure etc.


text: Crexendo Information Security Policy defines time periods within which a particular severity (critical v/s major v/s minor) vulnerability needs to be addressed. Reported vulnerabilities, along with applicable resolution timeline and efforts are recorded within the internal problem tracking system and are tracked as part of quarterly security and privacy review sessions.


text: As part of the proactive security measures, Crexendo deploys EDR/XDR tools across employee workstations, and mines significant events coming from critical infrastructure assets within a SIEM software. Any threat or prevention notifications are sent to IT & Security team for further analysis and additional actions are performed as deemed necessary to maintain the integrity and security of the corporate and production environments.


text: To be prepared for any natural or cybersecurity incident involving sensitive data breach across employees, customers, contractors, or vendors; and/or affecting service availability for the organization or customers, a comprehensive incident response plan along with disaster recovery & business continuity plan has been documented. The plan contains details on aspects including but not limited to – incident identification, operational playbook and responsibility matrix, communication and notification procedures, and reporting to legal/governing bodies based on severity of the incident. C level executives and the board are notified if warranted by the severity of the incident.


text: The plans are reviewed annually for enhancements and inter-department alignment. Tabletop exercises are conducted to measure the effectiveness of the plans and any findings are factored in towards further revisions of the plans.


text: Employee awareness towards potential threats and how to steer clear of any phishing or social engineering attacks, is a critical element that governs efficacy of any cybersecurity measures. To that end, Crexendo subscribes to periodic security awareness training, and mock tests for all employees and contractors. Employees and contractors are evaluated for timely completion of the trainings, on corresponding quiz scores, and based on how they fare tackling mock phishing emails. Worse than minimum required scores trigger actions to guide the person towards better security awareness and thereby score. Disciplinary actions are in store for employees/contractors who still fail to secure the minimum required score.


text: Crexendo has instituted a security team that is responsible for security/compliance strategy and corporate governance policies. The team makes sure that implemented SOC2 controls are supported by complementing processes and procedures.


text: Cybersecurity risk is managed thru effective inter-department cooperation towards assessing and remediating risks ranging across corporate IT, software development, software quality process, production network architecture and deployment, and data security/privacy.


text: Crexendo relies on a number of third-party vendors and contractors in order to provide products and services to its customers as well as to augment the resource pool. On an annual basis, all significant third-party vendors and subservice organizations are assessed for any applicable cybersecurity or service availability risks. Vendors and contractors with access to sensitive data and/or information are expected to meet certain information security requirements.


text: Executive buy in and support is a must for the success of any cybersecurity program. Crexendo C-suite executives and the Board of Directors have the primary responsibility of overseeing organizational cybersecurity and data privacy/security risk management.


text: Apart from any incidents that require notification to the top management and the board, an end-of-the-year update is presented by Crexendo security team to the executive management and the board. The update provides an overview of organizational security stature, any experienced incidents, in-flight security/compliance projects, and opportunities for improvement.


text: The Board factors in the input towards security and compliance program budget to strike a balance between the expense and corresponding risk.


text: Crexendo provides products and services within Software as a Service (SaaS) market segment. Specifically, the company provides hosted Unified Communication as a Service (UCaaS), where the customer base is highly sensitive towards privacy, service quality and service availability.


text: With the growing number of threats from a combination of bad actors, process lapses, human errors, and third-party vulnerabilities, Crexendo is subject to increasing and evolving cybersecurity threats.


text: While, we have a comprehensive cybersecurity and compliance program in place as an effort to counter the threats, and while we have not been subject to any cyberattacks that, individually or in the aggregate, have been material to Crexendo's operations or financial condition, there can be no guarantee that Crexendo will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyber attacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion.

companyName: UR-ENERGY INC

ticker: URG


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our Chief Financial Officer.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and HSE & Technical Committee of the Board each having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement. In addition to its other responsibilities, the HSE & Technical Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.


text: The HSE & Technical Committee and/or the full Board receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," above.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Officer is primarily responsible for this cybersecurity component and is a key member of Bank management, reporting directly to the Chief Operating Officer and, as discussed below, periodically to the Bank Board.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our cybersecurity program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence to facilitate and promote program effectiveness. Our Chief Information Officer and our Information Security Officer, report directly to our Chief Operating Officer, along with key members of their teams, who collaborate with peer banks and industry groups to review cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate management committees and Bank Board. The Incident Response Plan is coordinated through the Chief Information Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. For further discussion of risks from cybersecurity threats, see the section captioned "Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information, and adversely impact our reputation and results of operations" and "Our business continuity plans or data security systems could prove to be inadequate, resulting in a material interruption in, or disruption to, our business and a negative impact on our results of operations" in Item 1A. Risk Factors.


text: Our Chief Information Officer and Information Security Officer, along with their departments, are accountable for managing our enterprise information security and delivering our information security program. Their responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. Their departments, as a whole, consists of information security professionals with varying degrees of education and experience. Certain individuals within their departments are generally subject to professional education and certification requirements. In particular, our Chief Information Officer and Information Security Officer have relevant expertise in the areas of information security and cybersecurity risk management.


text: The Bank's Technology Steering Committee provides oversight and governance of the Bank's technology program and the information security program. Members of this committee include executive management, our Chief Information Officer, and our Information Security Officer. This committee meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. The Chief Operating Officer regularly reports summaries of key issues that would include cybersecurity incidents or other related information from the Technology Steering Committee to the Bank Board.


text: The Bank Board is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Officer and our Information Security Officer provide reports to the Bank Board, at least annually, regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Bank Board reviews and approves our information security and technology policies annually.


text: We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. The Company regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and containment. The Company has other policies and procedures which directly or indirectly relate to cybersecurity, including those related to remote access monitoring, encryption standards, antivirus protection, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: Our information technology security professionals who work closely with our Chief Technology Officer ("CTO") who is responsible for the detection and initial assessment of cybersecurity threats and incidents (collectively, "cyber incidents"), whether internal or experienced by significant third-party service providers, using, among other means, third-party software. The team classifies detected cyber incidents based on potential impact to the functionality of the affected systems, possible or known information involved, and recoverability effort. The classification of a cyber incident is designed to allow rapid prioritization, response, and escalation. The CTO and Chief Executive Officer ("CEO") are alerted as to any detected cyber incident that is potentially significant. Incidents are documented for regular internal reporting processes including notations and considerations of related attacks.


text: The CTO and CEO are required to engage the cybersecurity incident review if a cyber incident has materially affected, or is reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. The CTO and CEO are responsible for performing a materiality assessment, and overseeing the public disclosure of material cybersecurity matters, as appropriate.


text: We deploy quarterly cybersecurity training for employees and consider this a critical step in safeguarding the Company's data and assets. The training provides employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The training techniques to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide and includes interactive modules covering various areas, including insider attacks, phishing and email attacks, preventing malware attacks, data protection, data handling, passwords, cloud and internet security, and cybersecurity fundamentals for mobile devices.


text: Like other major corporations, we are the target of cyber-attacks from time to time. However, risks from previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, see "If we fail to keep our customers' information confidential or if we handle their information improperly, our business and reputation could be significantly and adversely affected" in Item 1A. Risk Factors of this Annual Report.


text: Cybersecurity is a significant part of our risk management processes and an area of focus of our Board of Directors and management. Our CTO is primarily responsible for assessing and managing material risks from cybersecurity threats. Our CTO has six years of cybersecurity experience.


text: The full Board is responsible for oversight of cybersecurity risk and receives regular reports from the CTO or CEO. Our CTO also present his assessment of material risks from cybersecurity threats to the Board at least annually. If a cyber incident is reported to the Board of Directors, our Incident Response Plan is triggered which involves a number of immediate actions be initiated. The impact, if any, of cyber incidents on internal control over financial reporting is discussed with the full Board.


text: The independent members of the Board, through the Board's nominating procedures and requirements, considers cyber expertise in vetting nominees for the Board and recommending Board committee appointments, and the Board has determined that one of its independent Board members has cybersecurity expertise.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats.

companyName: Ainos, Inc.

ticker: AIMD


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. IT leadership reports to our Chief Executive Officer (CEO) to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We promote a company-wide culture of cybersecurity risk management.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2023.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our executive management team inform the Audit Committee on cybersecurity risks on a regular basis, with a minimum frequency of once per year.


text: Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and report to our CEO. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents a key component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EASTERN CO

ticker: EML


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Director of Information Technology & Cybersecurity, and other members of management and relevant management committees and councils, including management's Cybersecurity Council.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt and appropriate internal reporting of certain cybersecurity incidents, either in the form of a single unauthorized occurrence or a series of unauthorized occurrences, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company has established and maintains comprehensive incident response and recovery plans intended to fully and timely address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to proactively address cybersecurity threats and prevent incursions, and to communicate the Company's evolving information security policies, standards, processes, and practices. Our awareness program includes assessment of our personnel's preparedness through regular phishing e-mail alerts, highlighted banners that warn about external senders, and tests administered to help the Company's personnel interrogate, navigate around, and avoid clicking suspicious and unfamiliar links from unknown senders.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as appropriate based on the information provided by these assessments, audits, and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Cybersecurity Council, which includes the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Director of Risk, and Director of Information Technology & Cybersecurity.


text: The Cybersecurity Council, in coordination with the Company's outside legal counsel, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Director of Information Technology & Cybersecurity and the Cybersecurity Council monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: The Director of Information Technology & Cybersecurity has served in various roles in information technology and information security for over 25 years, including the design and management of operational and cybersecurity activities of two large public companies. The Director of Information Technology & Cybersecurity holds undergraduate and graduate degrees in computer science and is certified in NIST, CMMC, CIS, and GDPR. The Company's CEO and CFO each hold undergraduate and graduate degrees in their respective fields, and each has over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We face cybersecurity risks, as a small company, due to the breadth of networks and systems we utilize to design, develop, produce and sell our LMR products. We also use third-party products, services and components to produce our LMR products. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to rebuild our internal systems, implement additional threat protection measures, provide modifications or replacements to our products, respond to regulatory inquiries or actions, pay damages, provide customers with incentives to maintain a business relationship with us, or take other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.

companyName: BK Technologies Corp

ticker: BKTI


text: We seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes, tools and changes or updates to our products; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our suppliers, our customers and the users of our products can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Risk Factors" for more information on our cybersecurity risks and product vulnerability risks.


text: As a supplier of LMR products to federal, state and municipality agencies, our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. We have retained the assistance of a Cybersecurity expert consultant, to assist internal management to evaluate processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our products and have processes to assess those issues for potential cybersecurity impact or risk. We are also implementing a process to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least twice annually, or more frequently as determined to be necessary or advisable.


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO) and Chief Financial Officer (CFO), who reports to our Chief Executive Officer (CEO). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our IT Director and the Cybersecurity consultant expert.


text: Many aspects of our business are dependent upon our computer systems, devices, and networks to collect, process, and store data necessary to conduct many aspects of our business, including the analysis of our products, the maintenance of our intellectual property, the recording and reporting of commercial and financial information, and payroll. We rely on standard operating systems and software from established and reliable third parties to provide security including Microsoft 365, QuickBooks, and Paylocity. The Company does not have in-house information technology personnel. Management makes concerted efforts to select third-party software providers with a demonstrated track-record of effectively addressing cyber-security concerns. In event of a cyber-security incident, we would rely upon these providers. In light of the Company's current size and relatively low cyber-risk profile, management believes that reliance upon experienced third-party providers is the most prudent and cost-effective course.

companyName: Zivo Bioscience, Inc.

ticker: ZIVO


text: To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: Our board stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. We outsource most aspects of our information technology management and these third party providers are available to address any cybersecurity issues that may arise.


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: PEDEVCO CORP

ticker: PED


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things, implemented (i) multi-factor authentication and password protection requirements for accessing all Company systems and applications such as Company electronic mail and the Company's banking and accounting environments, (ii) a secure email gateway using GoSecure that combines machine learning, behavioral scanning, exploit detection, signature-based detection and structure heuristics to provide defense against phishing and business electronic mail compromise attacks, spam, polymorphic malware, theft and other dangerous offensive content, (iii) endpoint protection using Microsoft Defender on Company and employee computers and Company-provided devices, (iii) a physical networking room with restricted access to only authorized personnel, (iv) regular cybersecurity training, awareness, and threat updates programs to keep all Company personnel updated and informed regarding emerging threats and best practices, and (v) daily cloud backups of the Company's accounting environment. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure of our information technology systems, including cybersecurity attacks or other data security incidents, could significantly disrupt the operation of our business." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our management team is responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator, and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, tests on our systems, review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants and computer security firms, to enhance our cybersecurity oversight including by gaining valuable insights into the ever-evolving cybersecurity landscape. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: In an effort to deter and detect cyber threats, we annually provide all employees with a data protection, cybersecurity, incident response, and prevention, training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Governance; Board Oversight The Audit Committee of our Board provides direct oversight over cybersecurity risk and provides updates to the Board regarding such oversight on a periodic basis. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.