text: 2. Executive Leadership Involvement: Senior management actively participate in setting cybersecurity objectives, allocating resources, and monitoring performance against established goals through the IT Steering Committee.


text: 3. Risk Committees: PyraMax Bank has established an IT Steering Committee responsible for overseeing cybersecurity risks and ensuring alignment with the Bank's overall risk management framework.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW

secItem: Item 1C


text: PyraMax Bank remains committed to maintaining the highest standards of cybersecurity to protect the interests of its customers, shareholders, and other stakeholders. By implementing robust risk management practices, strategic initiatives, and effective governance mechanisms, PyraMax Bank strives to mitigate cybersecurity risks and safeguard its operations against evolving threats.


text: In recognition of the evolving cybersecurity threat landscape, we acknowledge the increasing sophistication and frequency of cybersecurity incidents. While we cannot completely protect against the possibility of a cybersecurity incident occurring, we take measures designed to mitigate risks from cybersecurity threats, including those implemented by our third-party managed services provider.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: As part of our cybersecurity procedures, we leverage a number of security controls, including network and device monitoring and system backup procedures. We work to mitigate risks from cybersecurity threats stemming from third-party vendors by providing them with access only to systems that they need to provide services to us.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see "Item 1A, Risk Factors."


text: Senior management, including the Chief Executive Officer and Chief Financial Officer, are responsible for implementation of the Company's risk management controls, including controls in connection with risks from cybersecurity threats.


text: The Audit Committee of our Board of Directors is primarily responsible for overseeing the Company's compliance and risk management obligations, including the management of risks from cybersecurity threats. Pursuant to its charter, the Audit Committee is responsible for monitoring the effectiveness of the Company's information system and cybersecurity controls.


text: On a quarterly basis, the Audit Committee discusses with senior management, and internal audit, if applicable, the Company's processes for assessing, identifying, and managing material risks from cybersecurity threats and the state of the Company's cybersecurity processes. The Audit Committee also receives updates on, and monitors, the Company's prevention, detection, mitigation and remediation of cybersecurity incidents.


text: At Urgently, we understand the paramount importance of cybersecurity in safeguarding our operational integrity, customer information, and proprietary data. Our commitment to cybersecurity excellence involves a comprehensive approach to risk management and the continual enhancement of our cybersecurity protocols to address the dynamic nature of cyber threats.

companyName: Urgent.ly Inc.

ticker: ULY


text: Board Oversight and Cybersecurity Governance Our cybersecurity strategy is anchored in a governance structure with board-level oversight. The Board of Directors plays a critical role in guiding our corporate governance, our cybersecurity posture, ensuring that cybersecurity risks are adequately evaluated and managed in alignment with our business objectives. To this end, the Board will receive periodic updates on our cybersecurity initiatives, risk management practices, and incident response measures. This oversight ensures that cybersecurity remains a top priority at the executive level and that strategic decisions reflect our commitment to safeguarding our digital assets.


text: The Board is supported by and will receive reports from the Cybersecurity Risk Committee, a specialized group that includes senior executives and departmental representatives from information technology, legal, human resources, and operations. This committee is charged with the development of cybersecurity policies, evaluation of defense mechanisms, and oversight of the company's response to cyber incidents.


text: Our Cybersecurity Risk Committee is led by our CISO and our Director of Cyber Security and Compliance. These two individuals have decades of experience in designing, implementing, and managing cyber security risk programs. They are experts in the assessment, identification, and management of cybersecurity risk. Our Cybersecurity Risk Committee members receive updates about our security from our information technology and security teams, stay abreast of industry trends and regulations, and regularly inform management of various cybersecurity risks, trends, threats, and countermeasure techniques.


text: Our Cybersecurity Risk Management Program is informed by the Center for Internet Security (CIS) Controls version 18. The CIS Controls offer a strategic framework that directs our implementation of effective cybersecurity defenses across 18 critical areas, ranging from asset management to data protection and network security.


text: A cornerstone of our cybersecurity governance is the annual performance of comprehensive cybersecurity risk assessments. These assessments evaluate our defenses against the latest cyber threats and vulnerabilities and support our preparedness to respond to evolving cyber risks. The insights gained from these assessments inform our ongoing efforts to review and refine our cybersecurity strategies, policies and defense mechanisms. As a core component of our risk management process, all employees are required to participate in annual information security training.


text: We engage third parties annually to evaluate our information security posture, risks, and third-party service provider solutions as part of our overall enterprise risk management activities. The company maintains an inventory of vendors and third-party providers and evaluates those providers for risks annually at a minimum.


text: Incidents and Responses We have not experienced cybersecurity incidents that have materially affected our company, our business strategy, our results of operations, or our financial condition. However, we continue to face cybersecurity risks and recognize that we must remain vigilant against known and evolving threats. For additional detail about our cybersecurity risks and whether any such risks are reasonably likely to materially affect our company, please see the discussion in Item 1A, "Risk Factors."


text: Our commitment to cybersecurity resilience includes an ongoing monitoring program and a well-defined incident response plan that provides clear guidelines for mitigating the impact of any future cyber threats and incidents. These processes are periodically reviewed and updated to address emerging threat intelligence.


text: Future Directions Urgently will continue to invest in cybersecurity technologies, enhance our staff training programs, and foster collaborations with cybersecurity experts. Our board-driven, proactive approach to cybersecurity risk management is integral to our mission of delivering value to our customers, employees, and shareholders, safeguarding our reputation, and ensuring the long-term success of our company.


text: We have developed and implemented cybersecurity risk management practices intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management practices include a cybersecurity incident response plan.

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management practices include but are not limited to: • risk monitoring and assessments designed to help identify material cybersecurity risks from cybersecurity threats to our critical systems, information, products, services, and our broader enterprise IT environment; • internal and external IT professionals responsible for managing our (1) cybersecurity risk analysis, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assist with aspects of our security controls; • cybersecurity awareness training of our employees and senior management; and • a breach response and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: Although we face risks from cybersecurity threats, no known cybersecurity threats have materially affected or we believe are reasonably likely to materially affect us, including our business, financial condition, results of operations and growth prospects. See "Risk Factors – Significant disruptions of our or our vendors' information technology systems or cybersecurity incidents could result in significant financial, legal, regulatory, business, and reputational harm to us."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of our Board (the "Audit Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Audit Committee receives reports at least annually from management on our cybersecurity risks and would be informed of any cybersecurity incidents that management considers to be significant or potentially significant.


text: Our internal cybersecurity professional reports to our CEO and is responsible for assessing and managing our material risks from cybersecurity threats. The CEO is supported by our Chief Legal Officer in exercising primary oversight for our overall cybersecurity risk management program. Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: Danimer Scientific, Inc.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and leverage testing by our internal audit team, tabletop exercises, and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. The results of these assessments are reported to our Audit Committee.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: Our Vice President of Information Technology leads our internal IT team and is responsible for overseeing our information security program. Team members who support our information security program have relevant educational and industry experience. Our IT team members provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings. We also participate in a cybersecurity risk insurance policy.


text: For additional information regarding cybersecurity threats that may materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "If we experience a significant disruption in our information technology systems, including security breaches, or if we fail to implement new systems and software successfully, our business operations and financial condition could be adversely affected."


text: One of the functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole and through its committees. Particularly, the Audit Committee of the Board of Directors oversees our cybersecurity risk and receives regular reports from our Vice President of Information Technology on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, the Company has implemented a comprehensive Information Security Program ("Program") which is a component of its overarching enterprise risk management program. The Program is achieved through a collaborative effort involving operations, technology, compliance, risk, and senior management. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Key components of the risk management program include: • A risk assessment process that identifies and prioritizes material risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • Third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • A patch management system that safeguards our environment by keeping software up-to-date and resilient against threats. • Internal and external penetration testing that is conducted and reviewed either by independent third parties or qualified employees. • A third-party risk management program that is designed to ensure our vendors meet our cybersecurity requirements. • A training and awareness program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested at least annually.


text: The Board of Directors, including its Risk Subcommittee provides oversight of Company cybersecurity risks. The Board of Directors receives periodic reports on cybersecurity threats, awareness training, and key risk indicators related to cybersecurity. Additionally, the Company's Audit Committee provides oversight as it relates to annual audits related to information technology and cybersecurity. Management promptly reviews results of these audits to initiate necessary remediation, which are then reviewed by the Audit Committee.


text: The Board of Directors has designated the Security Committee and Incident Response Team with responsibilities related to information security and cybersecurity.


text: The Security Committee is a management committee with representation from operations, technology, compliance, risk, and senior management. The Security Committee monitors, reviews, and makes necessary changes to the Information Security Program. This Committee provides accountability for policies and procedures and reviews incidents that may affect information security.


text: The Incident Response Team has overall authority and responsibility for preparing and responding to incidents and consists of various sub-teams including representation from operations, technology, risk, compliance, human resources, and marketing. While key personnel have identified roles, this team ensures appropriate reports, statuses, and decisions are presented to the Executive Management and the Board of Directors.


text: The Company's Chief Technology Officer ("CTO") oversees the Company's information technology programs and investments. The Company's CTO has over 30 years of information technology experience. The Company's Compliance and Security Officer, who oversees the Company's information security programs, has over 10 years of experience and reports to the Chief Operating Officer. The Compliance and Security Officer is designated as the program coordinator responsible for coordinating and overseeing the Information Security Program.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including because of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, refer to Item 1A, Risk Factors of this Form 10-K.


text: We continue to assess and improve the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. We value the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security law. Our cybersecurity risks, and the controls designed to mitigate those risks, are included as a part of our overall risk management governance which is reviewed at least annually by our board of directors.

companyName: CV Sciences, Inc.

ticker: CVSI


text: Our IT networks and related systems are critical to the operations of our business and essential to our ability to successfully perform day-to-day operations. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a component of our internal control system. Cybersecurity awareness, including specific topics related to social engineering and email fraud, are included in our employee handbook. We have processes and controls, in particular with respect to our financial and reporting technology, to prevent and minimize cybersecurity risks and attacks. We rely on industry-standard third-party software and vendors for our core systems, including data storage, analysis and backup.


text: Our board of directors is responsible for overseeing our cyber security risk management and strategy. Our AVP Logistics, Systems & IT is responsible for managing our outside technology services and has over 10 years of relevant experience. The AVP Logistics, Systems & IT reports directly to our Chief Financial Officer and reviews cybersecurity assessments with our Chief Financial Officer on a regular basis. Our Chief Financial Officer is responsible for escalating any cybersecurity matters as appropriate. The Audit Committee of our board of directors will regularly review cybersecurity requirements and risks on a quarterly basis.


text: While we believe we have implemented appropriate measures and controls for our business, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, to our knowledge, there have been no incidents materially affecting the Company, but a material incident could result in disruption of critical IT networks and systems, impeding our operations, release of confidential information, and/or corruption of data. Such an incident could damage our reputation, brands, future sales and could expose us to potential liability.


text: Gaia recognizes the critical importance of maintaining robust cybersecurity measures to protect our systems, data, and operations and to maintain the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, including the management of risks arising from cybersecurity threats. It is our policy to provide regular updates to our shareholders regarding material cybersecurity incidents and the steps taken to address them. We believe that transparency in this area is crucial to maintaining trust and confidence in our operations.

companyName: GAIA, INC

ticker: GAIA


text: We have implemented a comprehensive cybersecurity program designed to identify, assess, and mitigate potential threats and vulnerabilities, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program includes regular risk assessments, network monitoring, penetration testing and incident response protocols. We also provide regular, mandatory training to our personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Our Senior Director of Operations/IT and his team work collaboratively across the Company and with our board of directors and management to maintain our cybersecurity program and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our board of directors and management receive periodic cybersecurity updates from our Senior Director of Operations/IT, which may include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to our cybersecurity program. The Company's Senior Director of Operations/IT has served in various roles in information technology and information security at Gaia for over 17 years.


text: Our commitment to cybersecurity extends beyond our internal operations. We work closely with trusted third-party vendors and partners to ensure that they also meet our rigorous security standards. We utilize third-party cloud computing services as part of our global business operations. We also employ the use of third-party content delivery networks (CDN) to help us stream content in high volume to our members over the internet. Problems faced by Gaia or any of our third-party cloud computing or other network providers, involving technological or business-related disruptions, as well as cybersecurity threats, may have an adverse impact on the member experience.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company to date, including our business strategy, results of operations or financial condition.


text: We are committed to protecting our information systems against cybersecurity threats. Any cybersecurity incident can adversely affect our business and disrupt our operations as described in greater detail in our Risk Factors relevant to cybersecurity risks. Our senior leadership, in consultation with our board of directors, has assigned responsibilities for ensuring and overseeing the operation of our information security program to the Marchex Information Security Committee (the "ISC") comprised of senior representatives of departments across our organization.

companyName: MARCHEX INC

ticker: MCHX


text: Effective risk management is a critical component of our operations. The ISC conducts a formal cybersecurity risk assessment annually. The assessment methodology is designed to identify cybersecurity threats to our information systems and considers a range of relevant risk factors that include both intentional and unintentional human acts by our or our vendors' personnel, or malicious third-party actors, risks inherent to technology/equipment we and our service providers use, as well as natural and environmental risks. The ISC discusses and documents mitigation strategies based on the risks identified. Results of assessments are reported to senior leadership and our board of directors. To the extent that any control deficiencies or material changes in the threat environment are identified, the ISC may make recommendations for new or improved controls and threat mitigation strategies.


text: The ISC also oversees day-to-day cybersecurity risk mitigation efforts, which include, but are not limited to monitoring systems for availability, performance, and security issues, periodic vulnerability scans, penetration testing performed at least annually by independent, reputable, third-party vendors, as well as evaluating any risk(s) associated with prospective third-party service providers who require access to sensitive customer data and implementing any additional controls to address significant risks identified. Furthermore, the ISC meets quarterly to discuss and analyze any relevant developments within the organization and industry relative to cybersecurity, reviews our internal policies and operational procedures relevant to cybersecurity at least annually, and promulgates updates when deemed necessary or advisable.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including, without limitation, intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal data (including sensitive personal data such as biometric data and employment-related data) ("Information Systems and Data").

companyName: Veritone, Inc.

ticker: VERI


text: Our Chief Information Officer ("CIO"), our Vice President of Information Security (who serves as our Chief Information Security Officer ("CISO")), and the Company's information security function help identify, assess and manage the Company's cybersecurity threats and risks. This team identifies and assesses risks from cybersecurity by monitoring and evaluating our threat landscape and the Company's risk profile using various methods, including, for example, manual and automated tools in certain environments and systems, subscribing to threat intelligence reports and services, scanning our environment for certain threats, evaluating our risk exposure, evaluating and analyzing certain reported threats, collaborating with law enforcement on certain threat intelligence, conducting internal and external cybersecurity audits, performing threat assessments in certain environments and systems, conducting vulnerability assessments in certain environments and systems, and engaging third-party experts for red/blue team testing and tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, vulnerability management, disaster recovery and business continuity planning, risk assessments, encryption of certain data, network security controls in certain environments and systems, data segregation of certain data, access controls for certain environments and systems, physical security, asset management, vendor risk management, employee cybersecurity training, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting and cloud-hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes the administration of a security questionnaire for certain providers, evaluation of certain provider's written security program, and review of security assessments and reports from certain providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factors captioned "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—The security or operation of our platform, networks, computer systems or data, or those of third parties upon which we rely, may be breached or otherwise disrupted, and any such breach or other disruption could have an adverse effect on our business and reputation" and "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—Interruptions or performance problems associated with our technology and infrastructure, or that of our third party service providers, including AWS and Azure, may adversely affect our business and operating results."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our CIO, who has over 20 years of expertise in overseeing corporate information technology functions, and our CISO, who has 20 years of experience in the cybersecurity industry.


text: Our CIO and CISO are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our CIO and CISO are also responsible for approving cybersecurity budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Company's Chief Executive Officer, CIO, security management team, and our legal team (including privacy). These stakeholders work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports, summaries or presentations from the CISO concerning the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity and other information technology risks. The audit committee oversees management’s implementation of our cybersecurity risk management program. Pursuant to its charter, the audit committee’s oversight of the integrity of our information technology systems and cybersecurity risks includes the review and assessment with management of the adequacy of controls and security for our information technology systems, processes and data, as well as our contingency plans in the event of a breakdown or security breach affecting our information technology systems.


text: As part of its oversight, the audit committee will receive reports from management on our cybersecurity risks including any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The audit committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, management may from time to time directly provide the full Board with briefings on our cyber risk management program, including presentations on cybersecurity topics from our Security Officer, internal security staff or external experts as part of the Board’s continuing education on topics that impact public companies.


text: Our management team, including our Director of Information Technology and our Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team’s experience includes 30 years of professional experience in all aspects of IT including enterprise software development, enterprise infrastructure design and configuration, development of integration infrastructure for health care systems and financial trading systems and technical support.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have implemented a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: password protection; multi-factor authentication; monitoring and alerting systems for internal and external threats; and regular evaluations of our cybersecurity program.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.


text: We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response Plan, which includes an Incident Response Process in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our head of administration will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Process to guide the response.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by head of administration and our managed service provider. Our head of administration has over four years of experience addressing cybersecurity risks. Our head of administration is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our head of administration oversees the Incident Response Plan and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: In its oversight role, our Board of Directors is expected to specifically consider risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.


text: On a regular basis, the head of administration reports to our Board of Directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.


text: Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our Board of Directors for consideration.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected our business, financial condition, results of operations, cash flows and prospects or that are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item IA—Risk Factors—Risks Related to Our Business."


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Our share of Bitcoins mined from our pools are initially received by us in wallets we control. We currently sell the majority of the Bitcoin we mine and utilize hot wallets to hold this Bitcoin immediately prior to selling for working capital purposes. We hold any remainder of our Bitcoin in cold storage. Bitcoins we mine or hold for our own account may be subject to loss, theft or restriction on access. Hackers or malicious actors may launch attacks to steal, compromise or secure Bitcoins, such as by attacking the Bitcoin network source code, exchange miners, third-party platforms (including Gemini), cold and hot storage locations or software, or by other means. We may be in control and possession of substantial holdings of Bitcoin, and as we increase in size, we may become a more appealing target of hackers, malware, cyber-attacks or other security threats.

companyName: LM FUNDING AMERICA, INC.

ticker: LMFA


text: Our management evaluates all cybersecurity matters, with the purpose of meeting at least semi-annually and providing recommendations with respect to our information technology use and protection, including, but not limited to, data governance, privacy, compliance and cybersecurity. We have implemented controls, policies, procedures and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of our IT systems and data that we believe to be reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. We are also required to comply with applicable laws, rules, regulations and contractual obligations relating to the privacy and security of our IT systems and data and to the protection of such IT systems and data from unauthorized use, access, misappropriation or modification.


text: To our knowledge there has been no security breach or incident, unauthorized access or disclosure, or other compromise of or relating to the Company or its subsidiaries hard wallets, cold wallets, information technology and computer systems, networks, hardware, software, data and databases, equipment or technology. We have not been notified of, and have no knowledge of any event or condition that could result in, any security breach or incident, unauthorized access or disclosure or other compromise to their IT systems and data, and we have implemented appropriate controls, policies, procedures, and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of our IT systems and Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. We are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT systems and data and to the protection of such IT systems and data from unauthorized use, access, misappropriation or modification.


text: Our Board of Directors considers cybersecurity risk and other information technology risks as part of its risk oversight function and meets at least quarterly to discuss matters involving cybersecurity risks. The Chief Executive Officer and Chief Financial Officer provide information to our Board of Directors regarding its activities, including those related to cybersecurity risks, and are responsible for notifying the Board of material cybersecurity incidents.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management ("ERM") approach, which is subject to oversight by our Board of Directors (the "BOD").

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a cybersecurity program that endeavors to identify risks, protect assets, detect threats, respond to incidents, and recover from damaging events in a prompt and effective manner with the goal of minimizing business disruptions through effective governance of people, processes, and technologies. • External Collaboration: We collaborate with third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats, including compromises of our information systems and our data's confidentiality, integrity, and availability. These include firewalls, disaster recovery capabilities, malware and ransomware prevention, access controls, and encryption. • Education: We provide monthly training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Incident Response Planning: We have established and maintain incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which a material incident would be communicated to executive management, our BOD, external regulators and shareholders. • Governance: Our BOD's oversight of cybersecurity risk management is led by the Company's Audit Committee, which oversees our ERM program. Cybersecurity threats, risks and mitigation are reviewed by the Audit Committee on at least an annual basis and such reviews include internal and independent assessment of risks, controls and overall program effectiveness.


text: Our risk assessment efforts have indicated that we are a potential target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized criminal groups, malicious insiders and activists. The impacts of attacks, abuse and misuse of the Company's systems and information include, without limitation, loss of assets, operational disruption and damage to the Company's reputation.


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through assessments and other exercises focused on evaluating the sufficiency and effectiveness of our cybersecurity risk management efforts. If a material weakness in our cybersecurity risk management program is identified, it will be reported to the Audit Committee and the BOD, as appropriate, and we will make adjustments to our cybersecurity processes and practices as necessary to eliminate or compensate for that weakness.


text: Our CFO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other Company management. We believe our business leaders, including our CFO, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our CFO collaborates with other Company business leaders to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents.


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to operationalize our cybersecurity risk management program. The Audit Committee will promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates. The Audit Committee periodically discusses our approach to cybersecurity risk management with our CFO, who oversees the Company's information systems.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition at this time.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending VII LLC


text: The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CISO has served in various roles in information technology and information security for many years and holds relevant professional certifications. The Adviser's COO and CCO each hold educational and professional degrees in their respective fields, and each has numerous years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: In the ordinary course of our business, we use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology vendor, which is overseen by our Senior Vice President of Administration, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability and data penetration testing, regularly review third party audits of our cloud-based technology vendors and perform ongoing regular risk assessments. We also conduct periodic employee training on cyber and information security, among other topics. In addition, to our third-party information technology vendor, we also consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: Our Senior Vice President of Administration who reports directly to the Chief Executive Officer and has over seven years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in "PART I, ITEM 1A, RISK FACTORS," under the heading "If we experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: The Board of Directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board receives at least quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President, Administration as well as other members of the senior leadership team.


text: We rely on our information technology to operate our business and understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis, we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify and manage material risks.

companyName: T2 Biosystems, Inc.

ticker: TTOO


text: As part of our broader risk management framework, we have identified potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication and recovery plans in the event of a cybersecurity threat or incident.


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework, and we are engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all critical third-party providers to help ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Our Board of Directors has assigned specific oversight responsibility for cybersecurity to our Audit Committee. The Audit Committee reviews and discusses with management our policies, practices and risks related to information security and cybersecurity. Our General Counsel has primary responsibility for assessing, monitoring and managing cybersecurity risks.


text: Our General Counsel provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.


text: We are committed to safeguarding the personal information of our customers and potential customers as well as our own sensitive data and information. The full Board of Directors (the "Board") is responsible for the Company's general risk oversight, including cybersecurity and data privacy risks. Members of the Company's senior management also have day-to-day responsibility for risk management and establishing risk management practices. The Board oversees senior management in their risk management capacities, regularly reviewing and analyzing the Company's risk levels and reviewing and analyzing inventory risk each quarter as part of their review of quarterly financial statements. Members of the Company's senior management have an open line of communication to the Board and have the discretion to raise issues from time-to-time in any manner they deem appropriate.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: The Audit Committee supports the Board by considering and reviewing the adequacy of the Company's internal controls with management and the Company's internal audit department, including the processes for identifying significant cybersecurity/data privacy risks or exposures, and elicits recommendations for the improvements to such procedures where desirable. The Audit Committee periodically reviews the Company's data security and privacy policies, procedures and risks. Members of management are expected to report matters to the Audit Committee or to the Board as a whole, as appropriate. Management's reporting on issues relating to risk management typically occurs through direct communication with directors or committee members as matters requiring attention arise.


text: We maintain a Data Privacy & Security working group that is responsible for setting data security and privacy policies, overseeing those policies, and tracking and reporting on data security and privacy performance. The working group is comprised of our Chief Information Security Officer, Global Data Privacy Officer, Chief Administrative Officer, and General Counsel. The working group reports to the Audit Committee at least annually. In addition, the Company has an Impact Committee that maintains functional working groups that focus on a number of issues, including Data Privacy & Security. The Impact Committee reports to the Board at least annually. The Company's Global Data Privacy Officer also reports to the Audit Committee at least quarterly and provides the Audit Committee with updates regarding the Company's data privacy environment. We also have a Chief Information Security Officer who reports to the Audit Committee at least annually regarding the Company's data security environment.


text: Our Chief Information Security Officer is certified as a Certified Information Systems Security Professional (CISSP) and has significant experience in monitoring, implementation and management within the disciplines of information and personal data security, disaster recovery, and asset management. He has over 10 years of service in U.S. Army Cyber Operations and within U.S. Army Cyber Command. Our Global Data Privacy Officer has served as our head of Internal Audit for nearly 10 years and has received privacy-related certifications from the International Association of Privacy Professionals (IAPP) including Certified Information Privacy Manager (CIPM) and Certified Information Privacy Professional / Europe (CIPP/e).


text: We perform an annual training exercise for all employees and hold several cybersecurity awareness campaigns throughout the year. Where deemed appropriate, we engage independent security professionals to evaluate the Company's security environment. For example, we comply with Payment Card Industry Standards and are audited annually by a third party to confirm compliance with those Standards. In addition, the Company employs third party penetration testers to identify potential security weaknesses for evaluation and remediation. We also partner with government organizations and industry associations to share intelligence and quickly respond to emergent threats.


text: In order to identify, assess, protect, detect, respond to and recover from cybersecurity threats, we seek to employ multiple industry best practices, processes and controls to minimize the personal information in our possession, including pseudonymization, anonymization, tokenization and encryption. In addition, the Company maintains technical and organizational measures to ensure that personal information is accessible only by authorized personnel. In the event of a data breach, the Company is committed to notifying impacted customers and/or appropriate government entities in accordance with applicable law without unreasonable delay and in all events within the time period specified by applicable law.


text: The Company plans to use reasonable, cost effective, and secure methods for notifications in the event of a data breach. While we have experienced and may continue to experience certain cybersecurity incidents, we do not believe any such incidents incurred to date have materially affected our Company, results of operations, or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A — "Risk Factors — Operational Risks — 'If we are unable to safeguard against security breaches with respect to our information technology systems, our business and our reputation may be adversely affected'," which should be read in conjunction with the information above.


text: Our cybersecurity risk management strategy and processes, which are integrated into our overall risk management process, for assessing, identifying and managing material risks from cybersecurity threats are designed based on established frameworks and standards developed by the National Institute of Standards and Technology ("NIST"). Although this does not mean that we currently meet all technical standards, specifications, or requirements, we use this framework, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity defense strategy based on prevention, detection and containment. We employ industry standard measures directly or indirectly related to cybersecurity, such as multifactor authentication, endpoint protection defenses, antivirus protection, encryption standards, restricting access based on business necessity, and remote access monitoring. Our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. The training provides employees with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. We engage third parties to conduct penetration testing and evaluate our adherence to industry-standard frameworks. We assess the security framework employed by our third party service providers including their reports on security, availability and confidentiality to assess and identify material risks from cybersecurity threats associated with our use of third party applications. We have also established liaison programs with the Federal Bureau of Investigation ("FBI") and U.S. Cybersecurity & Infrastructure Security Agency ("CISA") to monitor, identify, and counter advanced persistent threats specific to our company and industry. As part of this program, we have an FBI Special Agent assigned as our Liaison Officer who provides us with periodic cybersecurity threat briefings, and also provides counter-threat support on request.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Cyberattacks impacting our networks or systems may have a material effect on our operations."


text: Governance of cybersecurity risk management Our Board of Directors, acting through the Audit Committee, is responsible for overseeing management's implementation and execution of the risk management process, including our cybersecurity risk management strategy and processes. Our Audit Committee reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management.


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. We have formed a Cyber Security Incident Response Team ("CSIRT") to manage and govern the response to any real or suspected cybersecurity incidents. The CSIRT core team, consisting of the information technology team, classifies detected cybersecurity incidents into one of three categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of cybersecurity incidents is designed to allow rapid prioritization, response and escalation. The CSIRT core team engages with third party experts and cross-functional CSIRT members, as required, to manage the cybersecurity incidents. Cybersecurity incidents that are potentially significant or could result in a material impact are reported to the CSIRT Executive team, consisting of designated executives of the Company. The CSIRT Executive team is responsible for the oversight of the cybersecurity incidents and related critical decisions, performing a materiality assessment, overseeing the public disclosure of material cybersecurity matters, engaging law enforcement agencies, including our local FBI Liaison Officer, correspondence with the media, and communicating with our Audit Committee and Board of Directors, as appropriate.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our board of directors.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have engaged a third-party information technology ("IT") and cybersecurity firm who serves as our dedicated IT and cybersecurity team to help us oversee, implement and manage these processes and controls. This IT and cybersecurity firm is independently audited on an annual basis and has a System and Organization Controls Audit certification.


text: Processes and controls we have implemented with the assistance of our third-part IT and cybersecurity team to assess, identify, manage and protect against material risks from cybersecurity threats include the following: • perform 24/7 security monitoring through an automated detection software managed by our third-party IT and cybersecurity firm; • conduct regular phishing email training for all employees with access to corporate email and other systems to enhance awareness and responsiveness to such possible threats; and • requiring employees, as well as third parties who provide services on our behalf, to treat information and data with care.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to our Incident Response Team. The Incident Response Plan is designed to analyze, contain and remediate any cyber incidents that may circumvent existing safeguards. The Incident Response Plan encompasses a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal and external communication and disclosure protocols. We also maintain data backup procedures in the event of a cybersecurity incident. The Incident Response Plan is evaluated at least annually.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations. See "Risk Factors—Risks Related to Our Business and Properties—Cybersecurity incidents or other technology disruptions could negatively impact our business, our relationships, and our reputation."


text: As described above, we have engaged a third-party IT and cybersecurity firm to which we have delegated primary responsibility to oversee, implement and manage our processes and controls to assess, identify and manage risks from cybersecurity threats. Management receives monthly reports from the third-party IT and cybersecurity firm regarding cybersecurity incidents and any necessary remedial actions, data security posture and cybersecurity risk management processes and strategies. Management also meets quarterly with the third-party IT and cybersecurity firm to discuss technology and cybersecurity policies and procedures and risks and remediation actions.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the audit committee. As such, our audit committee is responsible for overseeing our overall risk assessment and risk management program as well as our policies and practices related to our information technology systems, information security and cybersecurity risks. Management is responsible for the day-to-day assessment and management of cybersecurity risks. Management works with the third-party IT and cybersecurity firm to identify, assess and manage cybersecurity risks. Our management team includes the chief executive officer and chief financial officer, each of whom has over twenty years of experience in supervising, managing, underwriting, owning, operating and assessing the risks of commercial real estate investments and commercial real estate operating companies. The audit committee reviews at least annually our enterprise risks and related risk management program. In addition, on a quarterly basis, the audit committee receives a report from management on our cybersecurity threat risk management and strategic process covering topics such as cybersecurity incidents and any remedial actions, if needed, data security posture and the results of third-party risk assessments as well as our cybersecurity risk management processes and strategies. Additionally, management would notify the chair of the audit committee following any cybersecurity incident meeting specified security levels, and the audit committee would review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC. Members of our board of directors that are not members of the audit committee are also kept apprised of material risks from cybersecurity threats and our related risk management activities.


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: While everyone at the Company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by the Board, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and tenant, employee and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cyberersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.


text: Additionally, we engage third-party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.


text: As of December 31, 2023, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" –"Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" in this Annual Report."


text: With oversight from the Board, the Audit Committee is primarily responsible for assisting the Board in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and protected health information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our information technology department, which is led by our Director of Information Technology, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, and other contractors and suppliers. We also conduct regular employee training on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: BIORA THERAPEUTICS, INC.


text: Our Director of Information Technology, who has over 15 years of experience managing information technology and cybersecurity matters and holds a Master's Degree in computer science with a concentration in cybersecurity, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Our Board of Directors, as a whole and at the committee level, has oversight of the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. Our Audit Committee, which is comprised solely of independent directors, oversees our cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Director of Information Technology as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Identifying, assessing and managing cybersecurity risks is an important component of Conifer's overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the Company and its consolidated subsidiaries.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: The Company and each of its consolidated subsidiaries are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access, and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee training; (vi) disaster recovery testing and (vii) security assessments of third-party service providers.


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past three fiscal years, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's our risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data (including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, "Information Systems and Data").


text: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our Information Systems Representative and Chief Operating Officer identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods designed to accomplish this task including, for example: manual and automated tools, subscriptions to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, and evaluating threats reported to us.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response strategies, systems monitoring, personnel training, cybersecurity insurance, data encryption strategies, network security controls, access controls, physical security controls, and asset management (such as tracking and disposal of Company information systems).


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT Department works with management in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers and professional services firms (including legal counsel). We also use service providers to perform a variety of functions throughout our business, such as application providers, data hosting providers, and CROs. We have a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategies may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, such as reviewing their information security documentation and imposing contractual obligations on them with respect to their information security controls.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could result in adverse consequences including, but not limited to, regulatory investigations or actions, litigation, fines/penalties, disruptions of our business operations, reputational harm, and loss of revenue or profits.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, threats, risks and mitigation. Our Audit Committee also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.


text: Our Information Systems Representative, in coordination with senior management including our Chief Operating Officer works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout our company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the Information Systems Representative and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. The Information Systems Representative has served in various roles in information technology and information security for over 25 years, including serving as the Director of Information Technology of another public company. Our Chief Operating Officer has over 7 years of experience managing information technology, including cybersecurity and risk management.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Terran Orbital Corp


text: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk and is aligned to our business goals and strategy. Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • the use of technologies, products, specialized IT tools and external service providers, where appropriate, to assess, test, understand, manage, mitigate and continually remediate identified risks, or otherwise assist with aspects of our security procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.


text: All cybersecurity risks are logged into our cybersecurity risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.