text: We use third-party service providers to perform a variety of functions throughout our business, including hosting providers, CROs, and CMOs. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes, as appropriate, risk assessments of vendors, reviewing our vendors' information security program, reports, audits, and imposing relevant contractual obligations on our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the heading "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences"

companyName: Y-mAbs Therapeutics, Inc.

secItem: Item 1C


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our Director of IT, HR & Administration, and our Chief Financial Officer, Treasurer and Secretary (CFO).


text: Our Director of IT, HR & Administration has been responsible for IT and cybersecurity for approximately 15 years across several organizations, and is currently responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO has had the overall IT and cybersecurity responsibility since inception of the Company in 2015 and is currently responsible for approving IT and cybersecurity related policies, processes, and procedures, approving related activities and budgets, helping prepare for cybersecurity incidents, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO and CEO, as appropriate and provides for our management team to work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: As part of its oversight of the Company's overall risk management, the audit committee is periodically updated by our CFO concerning cybersecurity threats and risks and the processes the Company has implemented to address them.


text: Our cybersecurity risk management initiative is a cornerstone of our information security program, which includes a cross-functional management team with representatives from Legal, Enterprise Risk Management, Information Security, Information Technology, and Engineering. The cybersecurity risk management work is directed by the Enterprise Risk Management Team in collaboration with the Information Security Team and is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our information security program includes a cybersecurity incident response plan and playbook.

companyName: Vertex, Inc.

ticker: VERX


text: We have designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management initiative is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management initiative includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a risk management team responsible for managing our cybersecurity risk assessment processes and acts as a check and balance on our information security team which is responsible for maintaining, monitoring, and updating our security controls as well as managing our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan and playbook that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A."Risk Factors – We are exposed to cybersecurity and data privacy risks that, if realized, could expose us to legal liability, damage our reputation, and harm our business."


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our general counsel, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our general counsel, with oversight by the Vertex Executive Leadership Team, is responsible for assessing and managing our material risks from cybersecurity threats. This team of attorneys and certified risk and information security professionals, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our general counsel's experience includes over twenty years of legal, information security, compliance, and risk experience and positions of leadership in global organizations supervising information security, compliance, and risk professionals and programs.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy Assessing, identifying and managing material risks from cybersecurity threats is critical for maintaining the security of the Company's data and information systems, and is integrated into our enterprise risk management systems and processes. The Bank's approach to cybersecurity risk management and strategy is based on the FFIEC Cybersecurity Assessment Tool ("CAT"), which provides a repeatable and measurable process for evaluating cybersecurity preparedness and assessing, identifying, and managing material risks from cybersecurity threats. The CAT incorporates cybersecurity-related principles from the FFIEC Information Technology Examination Handbook and regulatory guidance, and concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Bank First Corp

ticker: BFC


text: The CAT consists of two parts: Cybersecurity Inherent Risk Profile and Cybersecurity Maturity. Completion of both parts of the CAT allow management and the Board to evaluate whether the Company's cybersecurity risk and preparedness are aligned. The Cybersecurity Inherent Risk Profile is the level of risk posed to the Company by technologies and connection types, delivery channels, online/mobile products and technology services, organizational characteristics and external threats. Cybersecurity Maturity is designed to help management measure the Company's level of risk and corresponding controls under the following five domains: (i) Cyber Risk Management and Oversight; (ii) Threat Intelligence and Collaboration; (iii) Cybersecurity Controls; (iv) External Dependency Management; and (v) Cyber Incident Management and Resilience.


text: The Information Security Officer ("ISO") and the Company's Information Technology Committee conduct and review the CAT annually to identify changes to the Company's inherent risk profile; when new threats arise or when considering changes to the business strategy, such as expanding operations, offering new products and services, or entering into new third-party relationships that support critical activities. Consequently, management can determine whether additional risk management practices or controls are needed to maintain or augment the Company's cybersecurity maturity.


text: In an effort to continually share threat intelligence and increase awareness of cybersecurity trends, the Company has also implemented a Cybersecurity Education and Awareness Program. This program includes the following components: Mandatory annual cybersecurity employee training; Training specifically targeted to Senior Management and Information Technology staff; Bimonthly review of emerging security trends by the Information Technology Committee; Mandatory annual cybersecurity Board training;


text: Periodic communication to employees highlighting internal control requirements and information about common threats or fraud schemes; and Periodic communication to the Bank's customers highlighting emerging threats and good cybersecurity hygiene.


text: To date, we have not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. Please see Part I, Item 1A. Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Board and Management Governance The Company's Board of Directors recognizes the importance of maintaining the trust and confidence of our customers, employees, and shareholders. The Board of Directors' responsibilities for cybersecurity risk management and strategy include the following: Engaging management in establishing the Bank's vision, risk appetite, and overall strategic direction; Approving plans to ensure the use of the CAT;


text: Reviewing management's analysis of the CAT results, inclusive of any reviews or opinions on the results issued by independent risk management or internal audit functions regarding those results; Reviewing management's determination of whether the Bank's cybersecurity preparedness is aligned with its risks;


text: Reviewing and approving plans to address any risk management or control weaknesses; and Reviewing the results of management's ongoing monitoring of the Bank's exposure to and preparedness for cyber threats.


text: The Company has also appointed an ISO, who reports directly to the Audit Committee and shares a co-sourced relationship with an outside consulting firm. The ISO has been with Bank First for over 10 years in various operational and administrative roles. For the past four years, he has served as the Bank's Enterprise Risk Manager, and as ISO for the past two years. In 2022, he earned the Certified Banking Security Manager certification from SBS Cybersecurity. The ISO works closely with the head of Information Technology to ensure that the Bank's cybersecurity controls are in line with established internal culture, Board expectations and risk appetite, and all regulatory requirements. The ISO's responsibilities include the following: Developing a plan to conduct and complete the CAT; Working with the VP-Director of Technology to evaluate the results of the CAT; Leading employee efforts during the CAT to facilitate timely responses from across the Bank; Setting the target state of cybersecurity preparedness that best aligns to the Board of Directors' approved risk appetite; Reviewing, approving, and supporting plans to address risk management and control weaknesses; Analyzing and presenting the results of the CAT to the Board of Directors; Providing periodic cybersecurity updates to the Board of Directors;


text: Overseeing the performance of ongoing monitoring to remain nimble and agile in addressing evolving areas of cybersecurity risk; and Overseeing the Bank's cybersecurity preparedness.


text: Finally, the Company has established an Information Technology Committee to support the ISO in implementing the CAT, document formal action plans to be presented to the Board of Directors, enforce and implement the controls established by the CAT, and ensure employee compliance with internal controls


text: We have designed and implemented processes to assess, identify, manage, detect, and respond to material cybersecurity risks and threats to our IT systems, including the prevention, detection, mitigation, and remediation of cybersecurity incidents in order to protect the confidentiality, integrity, and availability of our IT systems and the information residing on those systems. These processes are part of our overall risk management process and are embedded in our operating policies, procedures, and controls.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: To protect our IT systems and information from cybersecurity risks, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified cybersecurity vulnerabilities and incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools. We also utilize a third-party security operations center connected to a networks operation center to identify, investigate, and resolve any cybersecurity threats and incidents.


text: We regularly assess technological risks to our IT systems and information and monitor our IT systems for potential vulnerabilities and risks. We frequently conduct mandatory cybersecurity and IT systems awareness training for all employees with access to our systems. We also conduct regular reviews and tests of our IT cybersecurity processes, including reviews, assessments, and exercises.


text: We aim to incorporate responsible practices throughout our cybersecurity risk management processes. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks to our IT systems and information. As a part of this process, we engage independent third-party specialists to review our cybersecurity environment, including formal reviews and assessments, and we request specific, actionable recommendations for improvement.


text: While we have not, as of the date of this Report on Form 10-K, experienced a cybersecurity threat or incident that has materially impacted our business or operations, there can be no guarantee that we will not experience such a threat or incident in the future. A material cybersecurity threat or incident could adversely impact our mining and manufacturing operations, our sales or financial and administrative functions, or result in the compromise of personal or other confidential information of our employees, customers, or suppliers. For this reason, we maintain cybersecurity liability insurance to provide additional support, expertise, and resources to help ensure the integrity of our cybersecurity processes through regular reviews and assessments, to provide incident response assistance and expertise, and to provide a level of financial protection in the event of cybersecurity incident related costs and losses. See "Risk Factors - We may be adversely affected by any disruption in, or failure of, our information technology systems, including due to cybersecurity risks and incidents."


text: Our Manager of Information Technology ("MIT") is responsible for our IT cybersecurity policies, procedures, and controls and reports to our Chief Financial Officer ("CFO"). Our MIT has a Bachelor of Business Administration degree in management information systems and has over 20 years of relevant experience in the IT field. Team members also include third-party service providers who have relevant education and experience in cybersecurity.


text: Our CFO is informed about and facilitates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the professionals on our cybersecurity team. In addition, we have an escalation process in place to inform our Chief Executive Officer and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.


text: Our Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our CFO and MIT regularly report to and review our cybersecurity processes with the Audit Committee, with formal cybersecurity reviews with the Committee generally occurring at least annually, and sometimes more frequently, as appropriate.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. Our cybersecurity program is overseen by our Chief Information Officer ("CIO"), who has more than 20 years of experience in information technology. This program incorporates policies, processes, and activities over domains such as access control; facility and data protection; IT systems and data transmission security; threat intelligence and incident response; third-party risk management; disaster recovery; and vulnerability management. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Thus, we base our program on multiple security frameworks including the National Institute of Standards and Technology ("NIST"), HIPAA, and privacy laws such as the E.U.'s GDPR. We also require that third-party service providers with access to personal or proprietary information implement and maintain cybersecurity practices consistent with applicable legal standards.

companyName: Quanterix Corp

ticker: QTRX


text: Cybersecurity is complex and subject to constantly evolving threats. Accordingly, we engage a range of external experts, including cybersecurity consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third-party experts includes regular audits, threat assessments, and consultation on security enhancements.


text: Our CIO is tasked with ensuring that the highest levels of management and our Board of Directors are informed about the cybersecurity posture and potential risks facing the Company. Our CIO regularly briefs our CEO about cybersecurity risk management. The CIO's staff regularly informs the CIO about the latest developments in cybersecurity, including potential threats and risk management techniques. In the event of a cybersecurity incident, the CIO is informed promptly following its detection, and our response is governed by a detailed incident response plan that includes prompt actions to mitigate the impact of the incident and longer-term strategies for remediation and prevention of future incidents. The CIO has also chartered an Information Security Steering Committee made up of cross-functional executive leaders that meets quarterly on topics such as the current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards.


text: Cybersecurity risk management is integrated into our broader risk management framework. The Audit Committee of our Board of Directors, which has responsibility for oversight of risk management, also has responsibility for oversight of our program, policies and procedures related to information security and data protection. On a regular basis, the CIO reports to the Audit Committee of our Board of Directors on cybersecurity risks as well as mitigation strategies and the status of initiatives to strengthen our information security systems. The CIO also provides periodic updates to our full Board of Directors, as appropriate.


text: For a discussion of our risks related to cybersecurity, see the section titled, "Item 1A. Risk Factors – Risks Related to our Operations – Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation. "


text: The Company recognizes the critical importance of maintaining the trust and confidence of our clients, business partners, and employees, and has developed an information security program to address material risks from cybersecurity threats. We have implemented a cross-functional approach to preserving the overall integrity of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to security incidents when they occur, while also maintaining controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: The Company relies on a comprehensive Enterprise Risk Management ("ERM") program, which includes cybersecurity as an important component. Our cybersecurity program is focused on the following key areas:


text: Risk Assessment. The Company engages in periodic cybersecurity and technology resilience risk assessments based on methodology and guidance from a recognized national standards organization; and utilizes periodic risk-based analysis for adopting, maintaining and adjusting appropriate security controls to address such risks.


text: The following factors, among others, are considered by the Company in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and severity of risk; impact on the Company and others, if a risk materializes; feasibility and cost of controls; and impact of controls on operations and on others. The specific controls used by the Company vary based on the systems involved, but usually include firewalls, intrusion prevention and detection systems, anti-malware technical safeguards and access controls, endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), and vulnerability and patch management.


text: The Company periodically tests its cybersecurity policies, standards, processes, and practices. These testing efforts conducted by our in-house security teams and by third-party security firms include audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Individual controls are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: Independent Assessments. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.


text: Third-Party Risks. The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Business Continuity and Incident Response. The Company has established and maintains comprehensive business continuity, disaster recovery, and incident response plans that address the Company's response to cybersecurity incidents. We conduct periodic tabletop exercises and other testing of these plans to enhance incident response preparedness for potential disruption to technology we rely on in our business.


text: The Company provides regular, mandatory training for personnel on cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices. The training includes phishing and smishing exercises.


text: Although the Company has confidence in the security measures and processes it deploys to protect its environment from cybersecurity threats, neither the Company nor the third parties it relies on may be able to fully, continuously, and effectively implement security controls as intended. As stated above, we utilize a risk-based approach and judgment to determine which security controls to implement, and it is possible we may not implement appropriate controls if we fail to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, but not fully eliminate, risks, and events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: The Company's Board of Directors (the "Board"), in coordination with its Audit Committee, oversees the Company's overall ERM process, and has delegated the management of risks arising from cybersecurity threats to the Security & Technology Committee, which regularly interacts with the Company's Chief Security Officer ("CSO"), Chief Information Officer ("CIO"), the Chief Privacy and Regulatory Compliance Officer, Chief Legal & Risk Officer, and other members of management. The Security & Technology Committee receives regular reports on the Company's cybersecurity risks, vulnerability assessments, third-party and independent reviews, among other relevant information.


text: The Board and its Security & Technology Committee also receive prompt and timely information regarding any cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incidents until they have been addressed. At least annually, the Board discusses the Company's approach to cybersecurity risk management with the Company's CSO, CIO, and Chief Legal & Risk Officer, and other members of management.


text: The CSO, in coordination with other members of TTEC executive leadership team, works collaboratively across the Company to implement a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and respond to cybersecurity incidents.


text: Our CSO holds an undergraduate degree in Computer Science and has served in various information technology and information security roles, including serving as the CISO/CSO for two public companies as well as various leadership roles in two medium sized private companies over the last 30 years.


text: Our CIO holds an undergraduate degree in Computer and Electrical Engineering and has served in various roles in information technology for over 25 years, including serving as either the chief technology officer or chief information officer for two large public companies and a technology start-up.


text: The Company has previously experienced significant cybersecurity incidents. Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and bad actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. Moreover, the nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Accordingly, we have devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: an internal cybersecurity team that is responsible for establishing security standards and conducting regular assessments of our information systems, controls, vulnerabilities and potential improvements; continuous monitoring tools to detect and respond to cybersecurity threats in real-time;


text: performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures;


text: third-party cybersecurity consultants, who conduct periodic penetration testing and vulnerability assessments to identify potential weaknesses in our systems and processes; and periodic cybersecurity training for our workforce.


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our program and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.


text: Our management team is responsible for the day-to-day management of risks we face, including our current Chief Operating Officer and Chief Security Officer. These officers are both experienced Certified Information Systems Security Professionals (CISSPs) who have more than 10 years of relevant experience in technology, security, and risk management across multiple industries, including finance and banking.


text: In addition, our board of directors, as a whole and through its Risk Oversight Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under NIST.

companyName: EchoStar CORP

ticker: SATS


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future. On February 23, 2023, DISH Network experienced a network outage that affected its internal servers and IT telephony. We immediately activated our incident response and business continuity plans designed to contain, remediate and recover from the situation. We engaged the services of certain cyber-security experts and outside advisors to assist in the evaluation of the situation, and once we determined that the outage was due to a cybersecurity incident, we promptly notified appropriate law enforcement authorities. In addition, on February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems.


text: After investigation and discussions with certain third parties, we determined that our customer databases were not accessed, however, we confirmed that certain employee-related records as well as a limited number of other records containing certain personal information were among the data extracted. We took steps to protect the affected records, received confirmation that the extracted data was deleted and notified individuals whose data was extracted.


text: The DISH TV, SLING TV and Retail Wireless services, along with our wireless and data networks remained operational at all times during the incident. As of March 31, 2023, all significant systems had been restored. We have no reason to believe that this cybersecurity incident has not been concluded.


text: We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: The Chief Information Security Officer ("CISO") leads our information security organization responsible for overseeing our information security program. Our CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.


text: In connection with the Integration, we anticipate that we will continue to evaluate and address as needed our cyber security risk management, policies, structure, strategies and governance to meet our needs.


text: IRadimed employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third-party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis. Our cybersecurity team works in conjunction with the management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into IRadimed's enterprise risk management process, and our information technology leadership reviews the Company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into the enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to, information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role; random employee phish testing, training and follow-up; procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities; the integration of multiple threat intelligence sources into our cybersecurity tools and processes; the retention of external cybersecurity threat response resources; and the formation of a multidisciplinary cybersecurity incident response team.

companyName: IRADIMED CORP

ticker: IRMD


text: The IRadimed board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risk and assists the Company's board of directors in fulfilling its oversight responsibilities regarding the Company policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing our information security policies and internal controls regarding information security; and reviewing the annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the cybersecurity program and receives regular updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. The Audit Committee oversees the Company's disclosure of any cybersecurity incident deemed material (and such materiality determination will be made by the Board upon recommendation of the Audit Committee) as required by the SEC or any other governmental authority, as applicable. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of vertical applications are required to document user access reviews regularly. We request a System and Organizational Controls ("SOC") 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.


text: To continually manage and control the material risks that cybersecurity threats present to the organization, IRadimed invests significantly in the cybersecurity elements outlined above. In addition, the Company has made investments to fulfill the operational and financial regulatory requirements laid out by the Sarbanes-Oxley Act of 2002.


text: IRadimed faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks.


text: We recognize the importance of maintaining the trust and confidence of our investors, patients, business partners, and employees. Our board of directors are actively involved in the oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the international organization for standardization. In general, we seek to address cybersecurity risks through a comprehensive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Collaborative Approach We have implemented a comprehensive cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have established and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: We maintain a comprehensive risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness We provide regular mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools and education to address cybersecurity threats and to communicate our evolving information security policies, standards, processes, and practices.


text: One of the key functions of our board of directors is informed oversight of our ERM, including risks from cybersecurity threats. Our board of directors receive regular presentations and reports on our cybersecurity risks, which have pertained to a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The board of directors also receive prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed and resolved.


text: On an annual basis, the board of directors discuss our approach to cybersecurity risk management with management which includes our Chief Information Officer ("CIO"). Our CIO has overall operational responsibility for our cybersecurity risk management. To facilitate the success of our cybersecurity risk management program, we have an Infrastructure, Operations & Security Team ("IOS Team") that is tasked with the responsibility to design, implement, and manage systems, processes, and policies to defend against cybersecurity threats and to respond to cybersecurity incidents. Working collaboratively across our Company, the IOS Team implements and maintains a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management system. We have a cross-departmental approach to identifying, assessing, and managing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board and its Risk Committee and Audit Committee (respectively, the "Risk Committee" and the "Audit Committee"), as well as senior management in, among other areas, the information security, information technology, operations, and risk management (including enterprise and operational risk) areas, devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and to identify and respond to cybersecurity threats and incidents in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, identification, and remediation. Our information technology and information security areas review enterprise risk management-level cybersecurity risks continually, and key cybersecurity risks are incorporated into the Company's Enterprise Risk Management Framework that supports its Risk Appetite Statement. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management. On an annual basis, the Board approves the Company's Information Security Policy and Program which provides a layered approach to cybersecurity, and includes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of customer information in accordance with applicable law.

companyName: SouthState Bank Corp

ticker: SSB


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's Chief Risk Officer ("CRO"), who oversees and supervises the risk function, including the information security, compliance, legal, operational (which includes business continuity, model risk, and third party risk functions) and enterprise risk areas. Our CISO has over 18 years of experience in information technology leadership, eight years of which is experience in leading information security oversight, and others on our information security team have various information security degrees and certifications within applicable disciplines. Our CISO receives reports from our information security team on a regular basis and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Our information security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external and internal control validations to assess our processes and procedures and the threat landscape, and we maintain a vulnerability management program designed to identify vulnerabilities and coordinate remediation efforts for any identified vulnerabilities in the environment. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, and vendors. Results of these ongoing activities are reported quarterly to management through the Cyber and Information Technology Steering Committee. In addition, we periodically perform simulations and tabletop exercises at the management level and incorporate external resources and advisors as needed. All employees are required to complete information security training at least once every year, and we require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.


text: We have continued to expand investments in information security and cybersecurity, including providing additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging third-party cybersecurity experts. For example, in 2023, the Bank engaged a third-party cybersecurity consultant to conduct a review of the Company's information security and cybersecurity program in relation to overall threat trends and specific factors affecting the Bank's cyber risk profile. The review assisted management in enhancing the Company's cyber-risk reduction efforts, including updating Bank's cybersecurity strategy and program. The Company also maintains cybersecurity insurance provided by carriers that can provide additional technical, legal, and consultation services in the event of a security event that requires additional staff or expertise, including attorneys, forensic accountants, and public relations professionals, among others. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers. Our third-party risk function conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. Our information security area regularly reviews third-party vendors and service providers, including their System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor or service provider is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess its cybersecurity preparedness and assess our relationship on that basis. The frequency and granularity of our review of third-party vendors and service providers is based on an assigned risk rating for each third-party vendor and service provider. Our assessment of risks associated with use of third-party vendors and service providers is part of our overall cybersecurity risk management framework.


text: The Board has ultimate oversight responsibility for the Company's risk management and recognizes the importance of protecting the data provided by the Company's customers and employees and devotes considerable time and attention to overseeing the strategies the Company employs to protect our data and systems and to mitigate against cybersecurity risk. A cybersecurity expert chairs the Risk Committee and provides technology-related insight and guidance to the Company. As part of the Risk Committee's responsibility for monitoring key business and regulatory risks, the Risk Committee receives from our CISO quarterly reports and materials which include a review of cybersecurity and information technology key risk indicators, test results and related remediation, and any recent cybersecurity threats or incidents and how the Company is managing those threats or incidents. The Risk Committee also periodically reviews reports on the threat environment, vulnerability assessments, results of penetration testing, and potential cybersecurity and data privacy incidents, as well as information on ongoing employee training relating to data privacy and cybersecurity and how to protect data against cyber threats. Further, on a quarterly basis, our CRO presents to the Risk Committee updates from our Director of Enterprise and Operational Management on the Company's business continuity program, which covers, among other things, outages and incidences and disaster recovery and business continuity testing. The Risk Committee also approves the annual risk assessment required by the Gramm-Leach-Bliley Act. Moreover, the CISO follows a risk-based escalation process to notify the Risk Committee outside of the cycle of regular updates when management has identified an emerging risk or material issue related to cybersecurity. The Risk Committee also reports material cybersecurity risks to the full Board, based on our CISO's assessment of risk. In addition, the Audit Committee reviews reports of the Company's internal audit department's periodic audits of our information security area and various components thereof.


text: We face a number of cybersecurity risks in connection with our business and we have, from time to time, experienced threats to and incidents involving our data and systems. For more information about the cybersecurity risks we face, see the risk factors captioned "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability " and " We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), adversely affect our business or reputation, and create significant legal and financial exposure." in Item 1A- Risk Factors.


text: Butterfly Network, Inc. uses, stores and processes data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: Strategy and Governance Under the ultimate direction of our Chief Executive Officer, our Information Security Committee has primary responsibility for overseeing our management of cybersecurity risks. It is chaired by our Chief Information Security Officer, or CISO, who reports directly to our Chief Executive Officer. Other members of the committee include representation from information technology, quality, product, operations, sales, and compliance as well as advisory support from internal audit.


text: Our CISO, working with his team and the Information Security Committee, has primary responsibility for assessing and managing our cybersecurity threat management program. The current CISO has more than 25 years of experience in building and leading information systems and security teams and has worked at a variety of institutions to implement and manage cybersecurity programs. These entities have included large, publicly-traded companies and smaller startups: The CISO's experience includes developing and maintaining tools and processes to protect internal networks, customer payment systems and cloud systems used by customers and the Company. The CISO also has a PhD in computer science and engineering and completed his thesis in information security.


text: The Information Security Committee meets periodically and as circumstances warrant to discuss and monitor prevention, detection, and remediation of risks from cybersecurity threats. When appropriate, cyber or information security incidents would be escalated by the CISO to our executive leadership team and/or our disclosure committee. On a regular basis, the CISO also updates the executive management team on developments within the cybersecurity sphere.


text: The Board of Directors has delegated oversight of the Company's cybersecurity program to the Audit Committee of the Board of Directors. As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing reports on data management and security initiatives and significant existing and emerging cybersecurity risks, including cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents.


text: Our CISO meets at least annually with the Audit Committee of the Board of Directors to discuss management's ongoing cybersecurity risk management programs. He provides information about the sources and nature of risks the Company faces, how management assesses such risks – including in terms of likelihood and severity of impact, progress on vulnerability remediation and current developments in the cybersecurity landscape. In turn, the Chair of the Audit Committee provides a readout to the full Board of Directors that includes a summary of the CISO's presentation to enable discussion of cybersecurity risk management at the full board level.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third party vendors' information systems. For more information, please see Part I, Item 1A " Risk Factors."


text: Processes for the Identification of Cybersecurity Threats Our Information Security team is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. It works with other groups in the company to understand the severity and the likelihood of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business. The Information Security team has processes designed to keep the company apprised of the different threats in the cybersecurity landscape – this includes intelligence networks alerts, working with researchers, discussions with peers at other companies, monitoring social media, reviewing government alerts and other news items and attending security conferences. The team also regularly monitors our internal network and out customer-facing network to identify security risks. In addition the team has completed several assessments and threat modeling tabletop exercises, based on "what-if" scenarios.


text: We have an employee education program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions. Security training is required upon hire for new employees, and on annual basis for the rest of the workforce.


text: As part of the assessment of the protections we have in place to mitigate risks from cybersecurity threats, we engage third parties to conduct vendor risk assessments. To assess the effectiveness of our program, we also have engaged consultants to conduct penetration testing and other vulnerability assessment.


text: Before purchasing third party technology or other solutions that involve exposure to the company's assets and electronic information, our Information Technology group requires those companies to complete a security review before being approved to work with the company. We utilize an external tool to manage critical vendors. Vendors are assessed to determine inherent and residual risk. Annually, the security team conducts a risk assessment that is informed by industry standards.


text: Listing the vulnerabilities company assets are exposed to Identifying the threats that may exploit such vulnerabilities Calculating inherent risk rating based on impact and exploitability Calculating residual risk by assessing mitigating controls


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party vendors. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our risk management and compliance program.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our cybersecurity policies, standards, processes and practices are fully integrated into the Company's enterprise-wide risk management and compliance program and overseen by the Audit Committee, and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall risk management and compliance approach, the Company's cybersecurity program is focused on the following key areas:


text: The Board's oversight of cybersecurity risk management is led by the Audit Committee of the Board, which regularly interacts with our Chief Compliance Officer, our Executive Director of IT, and other members of management.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, Security Information and Event Management systems, Extended Detection and Response with 24/7 Security Operations Center, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind.


text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, with leadership from the Audit Committee, oversees our cybersecurity risk management process. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with the Executive Director of IT.


text: Our Executive Director of IT, in coordination with our executive management team, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the Executive Director of IT and the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our Executive Director of IT has over 28 years of experience in leading IT teams and managing cybersecurity in several industries including biotech, media and consumer products. He has hands-on experience as an IT network engineer and systems administrator, configuring and hardening systems against security threats. In addition, he has previously held executive-level leadership IT roles. Throughout his career, he has kept abreast of new developments in cybersecurity and has implemented industry standards to secure IT infrastructure and systems. He works closely with the Company's IT managed service provider to assess all security incidents and events and escalate as needed.


text: No cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: We employ risk management, mitigation and prevention strategies based on frameworks provided by the National Institute of Standards and Technology ("NIST") regulation standards, third party cyber service providers, and common industry practices. These frameworks are applied across all network, hardware, software and communication platforms whether the platform is self-hosted or provided as a service. We leverage a Risk Assessment Score ("RAS") based on these standards against any internal networks, platforms, technologies or initiatives as well as any perimeter or connected partner, vendor or third-party service.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Our cyber posture, policies and in-production procedures are designed and developed to manage and minimize risk, threat, or loss to business processing, business objectives and business assets as well as protecting the integrity, confidentiality and personal identifying information ("PII") of our employees and partners.


text: Our security team is intentionally comprised of internal personnel with a range of technical, legal and management disciplines as well as external, third-party cyber service providers, auditors and technical consultants. This allows for broader monitoring, objective reporting, controlled policy, decreased recovery time objectives and quicker incident response.


text: We maintain cybersecurity risk insurance, conduct threat scenario exercises, provide end user cyber awareness and security training, perform regular vulnerability audits and formally report the relevant results, statuses or assessments to our senior management team or other identified key stakeholders.


text: Cybersecurity operations generally fall under the discretion of the IT Director, who has 20 years of experience and is certified as a Secure Infrastructure Specialist, Security Specialist, Network Specialist and IT Operations Specialist. Our IT Director regularly communicates with and provides relevant cyber reporting, analysis, statistics and statuses to the Chief Financial Officer, who also has a background in IT and is a Certified Information Systems Auditor. Our Cyber Incident Response Plan includes direction and formality on what events are immediately reported and to whom.


text: Our cyber policies are based on NIST and cyber coverage standards, requiring formal written policies, procedures, plans of action, general security plans and regular audits.


text: The Company's cybersecurity program, identified events, current and future strategies are presented to the Audit Committee for periodic review. The Audit Committee may choose to present relevant information to our board of directors (the "Board") as deemed necessary.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Systems and information technology interruption and breaches in data security and/or privacy could adversely impact our ability to operate and negatively impact our results of operations" in "Item 1A. Risk Factors."


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy, Written Information Security Policy and Incident Response Plan with Stellus Capital Management (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy also sets forth the role of our Chief Compliance Officer and our Information Security Team in preparing, implementing, and maintaining incident response procedures.

companyName: Stellus Capital Investment Corp

ticker: SCM


text: Our Chief Compliance Officer and Information Security Team are responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. At times we may also engage assessors, consultants, auditors or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of Stellus Capital Management who provide services to us pursuant to the Administration Agreement.


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors," in this Annual Report on Form 10-K under the heading " We, Stellus Capital Management and our portfolio companies are subject to risks associated with "phishing" and other cyber-attacks. "


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Team as needed, but no less frequently than annually. On at least a quarterly basis, the Information Security Team reports to our Board on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and Information Security Team's evaluation of cybersecurity risks that are material to us.


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented and utilize a risk-based approach that incorporates various information security processes designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity and availability of information technology systems and the data residing therein. The critical data contained on our information systems include intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive, personal information that we collect, use, store and transmit digitally in the ordinary course of our business. These processes are managed and monitored by a dedicated information technology team, which is led by our Senior Vice President of Information Technology, and include mechanisms, controls, technologies, systems, and other processes designed to monitor and evaluate our threat environment, prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Our cybersecurity program is informed by certain industry standards and best practices as outlined by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We use email security tools, managed detection and response, third party managed security services, regular vulnerability scans and threat intelligence feeds. We also have an incident response plan designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We assess third-party service providers with a cyber security questionnaire and a follow up meeting or audit based upon the risk profile of the third party with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices intended to be consistent with applicable legal standards and industry best practices.

companyName: Apogee Therapeutics, Inc.

ticker: APGE


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. To mitigate the aforementioned consequences of cybersecurity incidents, we carry cyber attack insurance. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Our Senior Vice President of Information Technology, a certified CISSP, who reports directly to the Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Information Technology. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program, which is based on recognized industry standards and frameworks, is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Consolidated Communications Holdings, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Directors (the "Board") regularly considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Board receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents.


text: The Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics which may pose potential impacts to the Company's operations from our Chief Technology Officer. Board members also receive external training or attend seminars on cybersecurity topics that impact public companies as part of their continuing education.


text: Our management team, including our Chief Technology Officer, Senior Director of Information Security and other members of the IT team are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Technology Officer joined Consolidated in 2017 and has more than 30 years of communications industry experience. Prior to joining Consolidated, he served as the Chief Technology Officer at FairPoint Communications, Inc. and also held key leadership roles at Comcast and Level 3 Communications.


text: Our management team oversees the efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; as well as providing ongoing cybersecurity awareness training for our employees including management.


text: Cybersecurity and privacy incidents in the pharmaceutical industry are growing in frequency and severity, prompting organizations to invest heavily in people, processes, and technology to bolster their cybersecurity risk management capabilities.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: We assess the integrity of our information technology and cybersecurity platforms to help ensure proper safety measures are implemented. We understand the extensive responsibility associated with safeguarding our systems and data. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include:


text: We utilize various securities tools and technologies designed to prevent, identify, protect, detect, escalate, respond and recover from cyber threats in a timely manner. Our approach includes real-time monitoring, threat analysis, and regular security evaluations to identify and mitigate potential vulnerabilities.


text: User Training & Education: We realize that human error can be a significant cybersecurity risk, so we have implemented education and training programs for our staff to raise awareness about cybersecurity best practices. By promoting a culture of security consciousness, we empower our staff to identify potential threats and respond effectively, in a way that is designed to enhance the overall cybersecurity posture of our organization.


text: Incidence Response and Business Continuity: We have comprehensive Incidence Response and Business Continuity plans in place designed to ensure the continuity, availability and accessibility of our systems and data, even in the face of unforeseen events such as natural disasters or cyber incidents, which plans and systems we test regularly.


text: We rely upon the capacity, availability and security of our information technology hardware and software infrastructure. We maintain comprehensive compliance and security programs designed to help safeguard and ensure the integrity of the confidential information we possess, which includes both organization and technical control measures. We routinely conduct employee trainings on important information security procedures and test and measure compliance with these security measures. In addition, we maintain cyber insurance policies that mitigate the financial risk of any potential incident.


text: We engage consultants, auditors, and other third parties in connection with such processes. We work with third-party service providers to assist us in our cybersecurity risk management to identify areas that may potentially impact our business, develop and implement control framework to mitigate such cybersecurity risks, and to be prepared to respond to and report (as required) applicable cybersecurity incidents.


text: We face a number of risks including the growing threat of cybersecurity attacks. Despite our implementation of security measures to combat the threats of cybersecurity attacks, any system failure, accident or security breach could result in disruptions to our operations. To the extent that any disruption, cybersecurity attack or other security breach results in a loss or damage to our data or inappropriate disclosure of confidential information, our business could be harmed. In addition, we may be required to incur significant costs to protect against damaged caused by these disruptions or security breaches in the future.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced cybersecurity challenges (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding risks from cybersecurity threats, please refer to "Item 1A. Risk Factors" of this annual report on Form 10-K.


text: Our Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management. This committee periodically reviews and assesses the risk exposure of our risks related to data privacy, technology and information security, including cyber-security, and back-up of information systems and makes recommendations to our Board of Director pertaining to monitoring and minimizing findings in such assessment. This committee periodically reports to the Board of Directors.


text: While the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management, our management also plays an integral role in cybersecurity oversight. Our management is responsible for day-to-day risk management processes. This includes periodic updates from the Executive Director of Information Technology who has over 23 years of work experience in the life science industry, and holds an undergraduate degree in Industrial Technology. The Executive Director of Information Technology is responsible for managing the daily measures of safeguarding the information technology infrastructure from potential threats and vulnerabilities, which includes monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, we have established a Crisis Management Team (CMT), which is a team of cross-functional participants who are prepared to review and assess any potential cybersecurity incidents. The CMT team is led by our CFO and our General Counsel who will advise the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee of the Board accordingly in the event of any incident. We believe this division of responsibilities is the most effective approach for addressing our cybersecurity risks and that the Board leadership structure supports this approach.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: MARINUS PHARMACEUTICALS, INC.


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes several safeguards, such as password protection; multi-factor authentication; continuous monitoring and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic audits and incident response simulations; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees and contractors, as well as annual cybersecurity awareness training for our employees and contractors. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including providing our code of conduct to our vendors and conducting due diligence in connection with onboarding new vendors.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a cybersecurity incident response program. Pursuant to the program and its procedures, a Security Incident Response team (SIRT), which is a team lead by the Head of IT and comprised of cross-functional personnel, is responsible for handling potential cybersecurity incidents. We also maintain business continuity and disaster recovery plans in the event of a significant cybersecurity incident.


text: We have relationships with a number of third-party service providers to assist with cybersecurity event and incident identification, response, containment and remediation efforts.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Chief Financial and Operating Officer. Our Head of IT is responsible for the day-to-day management of the cybersecurity program and provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters and reports up to the full Board of Directors. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures.


text: The Head of IT updates the Chief Financial and Operating Officer who apprises the Audit Committee and Board of Directors of cybersecurity incidents consistent with our cybersecurity incident response plan promptly for any cybersecurity incidents, if applicable.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management (ERM) process. As part of our ERM process, cross-functional leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity.


text: We also maintain specific coverage to mitigate losses associated with certain cybersecurity incidents. To date, we have not experienced any material cybersecurity incidents or threats. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors.


text: WhiteHorse Finance, Inc. (the "Company," "we," "us," or "our") has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of WhiteHorse Advisers, LLC (the "Investment Adviser") and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Investment Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Investment Adviser's risk management program and processes, which include cyber risk assessments.