text: Our cybersecurity program uses layered security defenses, cyber resiliency and automation capabilities for our security functions and operations. Our cybersecurity roadmap outlines and defines the security initiatives, projects and tasks. Security investments and projects are discussed by the Security Steering Committee ("SSC").


text: We engage with a range of third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of our cybersecurity program. Services provided by these third parties include 24/7 security logging, network and endpoint monitoring, vulnerability scanning, penetration testing, security incident response tabletop exercises and security and compliance posture assessments. Vendor security monitoring is an important component of our cybersecurity program to ensure our vendors are securing and protecting our critical infrastructure, data, and information, integrated with our contract management process, including security addenda and vendor security risk assessments for new contracts and annual vendor security risk assessments for critical vendors.

companyName: Dine Brands Global, Inc.

ticker: DIN

secItem: Item 1C


text: Our security incident response plan provides guidelines and requirements for reasonable and consistent responses to security incidents to limit damage while preserving the confidentiality, integrity and availability of Company systems and information, and reducing recovery time and cost, including but not limited to, escalation of security incidents to appropriate team members for investigation and response and documenting the required steps for investigation and remediation taken during the security incident response. We perform an annual tabletop exercise led by third-party security experts with participation from executive management and technical internal teams.


text: Our employees and vendor partners are also trained to report any security events to the cybersecurity team, who will escalate and notify the legal team, senior executives, and Board of Directors as needed.


text: As of the date of this report, we are not aware of any actively exploited security risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management program is informed by legal and regulatory requirements and considerations. Cybersecurity risks are included as an integral part of our broader Enterprise Risk Management ("ERM") program and reviewed regularly by internal stakeholders comprised of a cross-functional team to assess the risk level and strength of our mitigation strategies. Our cybersecurity risk assessment is performed regularly throughout the year, and may include: • Regular cybersecurity program, risk and incidents reporting to the Board of Directors; • Regular cybersecurity risk reporting to the Enterprise Risk Committee, which includes the Company's Chief Executive Officer, Chief Financial Officer, Senior Vice President, Legal, General Counsel & Secretary, Internal Audit, Chief Information Officer and Chief Information Security Officer ("CISO"); and • Routine Security Steering Committee meetings with members from the Company's cybersecurity, ERM, Information Technology ("IT"), internal audit and legal teams.


text: Our CISO leads our cybersecurity team and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has 30 years of experience serving in various roles related to cybersecurity and information security. The SSC, chaired by our CISO, is comprised of executive level representatives from our IT, legal, enterprise risk management and internal audit teams and is responsible for oversight, evaluation and coordination of activities related to safeguards, security risk, controls, remediation activities, policy governance and other related security program activities.


text: The Board of Directors is responsible for overseeing overall risk management for the Company. The Audit Committee receives reports from the CISO regarding the cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Members of the Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Cybersecurity risks are critical to our business and our process for identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. We rely on complex information technology systems and networks to conduct business, including communicating with employees and our distribution centers, ordering and managing materials from suppliers, selling and shipping products and analyzing and reporting results of operations, as well as for storing sensitive, personal and other confidential information. While we employ resources to monitor and protect our technology infrastructure and sensitive information, these security measures or those of our third-party vendors may not prevent all attempted data security breaches or cyber-attacks. If our or our third-party vendors' information technology systems are damaged or cease to be available or function properly for an extended period of time, whether as a result of a significant cyber incident or otherwise, our ability to communicate internally as well as with our customers could be significantly impaired, which may adversely impact our business. Our acquisition strategy may also result in exposure to certain technology risks during integration of systems of acquired companies to our existing platform.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Addressing cybersecurity risks requires ongoing monitoring and vigilance, and the Company is making enhancements to its cybersecurity policies, procedures and practices to safeguard sensitive information as well as information from our partners, customers and employees. We employ a risk-based strategy, aligned with the National Institute of Standards and Technology Cybersecurity framework, focused on safeguarding critical assets by implementing controls around access, data, and infrastructure security to protect the confidentiality, integrity, and availability of our data. Maturation and refinement of the Company's cybersecurity risk management strategy and related procedures is a continuous activity to ensure appropriate identification, assessment, and response to risks from cybersecurity threats that may adversely impact our operations. Our employee training and awareness programs are in place to improve cybersecurity awareness throughout the organization and we are committed to educating our employees on best practices for data protection, phishing awareness, and incident response. We also engage with third-party cybersecurity assessors, consultants, and auditors that provide independent assessments of our systems and processes, as well as those of certain third-party service providers, contributing to our efforts to strengthen our cybersecurity posture and enhance our defenses.


text: On January 31, 2022, certain computer systems related to the Aurora acquisition that had not yet been integrated into our main systems were the victim of a cybersecurity attack. We immediately took steps to isolate those systems and implemented measures to prevent the spread of the attack, including taking systems offline in an abundance of caution. Together with an outside cybersecurity forensics firm, we investigated the attack to determine its nature, scope, duration, and impacts, as well as our vulnerability to another such attack and whether there was any exfiltration or misappropriation of data. There was no evidence that the attack extended beyond the Aurora acquisition's systems, and it was determined that no critical data was accessed. We have subsequently integrated the acquisition's systems with our main systems, which we completed in 2024.


text: As of December 31, 2024, we are not aware of any cybersecurity incidents or identified risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition. There is no guarantee that cybersecurity incidents or risks from cybersecurity incidents may not be material in the future. We maintain cyber insurance coverage to supplement our cybersecurity program given the complex and evolving nature of global cyber threats; however, the insurance may not be sufficient to cover all losses from any breaches of our systems and does not extend to reputational damage or costs incurred to improve or strengthen systems against future threats or activity. Given the increasing sophisticated threats, a disruption from a cybersecurity incident is possible to occur and we are actively taking actions to minimize the likelihood and impact of such incidents. In the event of such an incident, our information security team is continuously engaged to investigate and respond, including isolating systems, performing forensics, containing and eradicating malicious activity, and recovering systems in-line with business expectations and operations.


text: Our board of directors oversees the cybersecurity risk management program and is regularly informed of cybersecurity risks through periodic updates provided by the Director of Information Technology ("IT") and Information Security team, to address our cybersecurity processes and risk mitigation efforts. Certain members of the board of directors have cybersecurity risk certification credentials and experience with, and exposure to, cyber risk oversight. The periodic updates provided by the Director of IT and Information Security team to the board of directors generally encompass emerging cyber threats, the Company's security posture changes, significant cybersecurity incidents, progress of risk mitigation efforts, and cybersecurity strategies and investments. The frequency of these updates allows for timely decision-making and ensures that our board of directors is fully informed of our cybersecurity risks.


text: Our Director of IT is responsible for identifying, assessing, and mitigating cybersecurity risks across the Company. Supported by our Information Security team, the Director of IT monitors the cyber threat landscape, plans and implements security controls, and responds to incidents. The collective team has extensive experience in information security and cybersecurity risk management and performs detection and monitoring of cybersecurity threats and incidents on an ongoing basis using a combination of security tooling, automated systems and manual processes.


text: We understand the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Cybersecurity processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated into our operations as a part of our overall risk assessment process.

companyName: Ocugen, Inc.

ticker: OCGN


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party cybersecurity firm to assist with aspects of our cybersecurity program including, but not limited to, network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. We also maintain cyber liability insurance.


text: Our processes also include assessing cybersecurity risks associated with our use of third-party services providers in the normal course of business use. We assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems.


text: There have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this Annual Report, including "Our internal computer systems or those of our development collaborators, third-party CDMOs, or other contractors or consultants may fail or suffer cybersecurity incidents, data breaches, or other disruptions, which could result in a material disruption of our product development programs and cause our business and operations to suffer," for additional discussion about cybersecurity-related risks.


text: Cybersecurity is an important part of our risk management processes. Our Associate Vice President of IT & Facilities is responsible for overseeing the cybersecurity risk management program. He has over 20 years of IT management, cybersecurity, and information governance experience. In order to monitor and appropriately escalate cybersecurity risks, our Associate Vice President of IT & Facilities receives reports on a monthly basis, and more frequently as appropriate, from our third-party cybersecurity vendor.


text: Our Board's role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks both at the Board and Committee level. The Board conducts its risk oversight by receiving reports from each of the Committees and our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats. Our Associate Vice President of IT & Facilities briefs the Audit Committee on our cybersecurity risk management program on a quarterly basis, using risk assessment reports from our third-party cybersecurity vendor. The briefing includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.


text: Our business operations rely on the secure processing, storage, integrity, and transmission of business-critical information, including transaction information as well as personal and other sensitive data, through digital and interconnected systems, including those of our service providers and other third parties. In order to identify, prevent, respond to, and mitigate cybersecurity risks, we maintain a formal data protection program with physical, technical, and administrative safeguards (the "Program"), which is integrated into our overall risk management processes. As part of the Program: • We have implemented and maintain documented policies and comprehensive technical controls (including multifactor authentication and end-to-end encryption) designed using the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and mapped to the specifications of International Organization for Standardization ("ISO") 27001. The Program is regularly reviewed and updated on an annual basis, with a comprehensive annual review cycle. • We maintain a dedicated cybersecurity team under the joint direction of our Executive Vice President and President – Global Platforms Group, and our Chief Information Security Officer ("CISO"). Our cybersecurity team operates a 24/7 Security Operations Center that employs threat detection and response technologies, including AI and ML capabilities. In addition, we maintain the Ingram Micro Trust Center, a centralized hub for stakeholders and the public to access key information about our cybersecurity and privacy programs. • We regularly test our internal IT controls through a combination of automated and manual testing procedures, including continuous automated vulnerability scanning and periodic penetration tests, and we regularly test our disaster recovery and other back-up plans. Our Program also undergoes annual external audits by independent auditors as part of our ISO 27001 certification process. Critical vulnerabilities identified through these processes are remediated according to defined timelines based on severity and other relevant factors. • We maintain, and we require our third-party service providers to maintain reasonable security controls designed to protect the confidentiality, integrity, and availability of our information systems and the sensitive data we process or that is processed on our behalf. We address potential risks posed by the use of such third-party service providers via established vendor risk assessments, due diligence, and contract review by our cybersecurity team. • We require our employees to complete security awareness training upon hiring and on a regular basis, with modules covering applicable Company policies and emerging threats. Our training program includes practical exercises such as simulated phishing campaigns.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our program, including accountants, independent assessors, external legal counsel, and other consultants.


text: Our incident reporting and escalation process is designed to detect and analyze cyber incidents in real time, to assess their impact, to escalate the incident to our CISO and the Company's Information Security Management Committee (which consists of our CEO, CFO, General Counsel, CISO, and EVP and President – Global Platform Group), as appropriate and consistent with our Incident Response Plan, and to determine and effectuate the appropriate response and reporting actions, including evaluating the impact and materiality of such incidents to our financial condition and operations.


text: All cybersecurity threats are documented by our Security Incident Response Team, with incidents exceeding a certain threshold escalated to our CISO. Critical incidents involving confirmed data breaches, ransomware, or system-wide outages trigger immediate Security Management Committee involvement and require the board of directors to be informed of significant or material cybersecurity incidents within 24 hours.


text: While we, along with our customers, vendors, suppliers, and service providers, are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate, has materially affected the Company during the periods covered by this report. See Item 1A, "Risk Factors", for more information on the cybersecurity threats facing our Company.


text: Our board of directors maintains active oversight of cybersecurity risks through a structured governance framework: • The full boar d of directors receives comprehensive cybersecurity briefings at least annually, supplemented by sessions focused on emerging threats and program strategy. • The Audit Committee receives regular updates (typically quarterly) that cover, among other topics, performance against operational metrics and results of recent audits and assessments. • Our CISO, under the direction of our Executive Vice President and President – Global Platform Group, leads our Program, working with key stakeholders and resource groups, including industry groups, peer institutions, internal committees (the Information Security Management Committee), and law enforcement, as needed, to understand, identify, and address cybersecurity risks. Our CISO maintains direct reporting access to the board of directors, ensuring that time-sensitive matters may be escalated as needed. • Our internal audit team is responsible for testing key IT controls, while leaders from our legal, finance, communications, and risk management teams participate in incident response training, including annual tabletop exercises, to ensure swift and effective responses to cybersecurity incidents.


text: Our cybersecurity leadership team brings extensive qualifications and expertise: • Our CISO has over 15 years of experience in information security, including leadership roles at Nissan Motors and Ingram Micro. He has performed investigations in the public sector as a deputized high-tech crimes investigator with a digital forensic certification. He serves on numerous cyber industry organization boards and lends his expertise as a leader and practitioner. He speaks at numerous events annually on various cyber topics. • Members of the broader security team maintain various professional certifications including CISSP, CISM, CEH, and SANS certifications. We maintain partnerships with leading universities to support continuing education and stay current with emerging threats and technologies.


text: Aquestive's cybersecurity program is built on four key pillars: Governance, Process, Compliance and Audit. While we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, and results of operations, Aquestive's cybersecurity program is built upon a set of policies, procedures, and standards supported by training and awareness. In addition, cybersecurity risks are also reviewed as part of our overall Enterprise Risk Management program.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: The cybersecurity team has significant experience in managing cybersecurity programs and has engaged with a MSSP to deploy state of the art cybersecurity technologies and gather threat intelligence and cyber risk trends. The cybersecurity program is executed with the MSSP, which provides active threat monitoring, risk assessment and incident response capabilities to timely assess and address any material cyber risk that could impact our business operations.


text: On occasion, we engage other external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to Aquestive. We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate. We rely on the expertise of our risk management, legal, information technology, and compliance personnel, as well as our MSSP, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Role of Management/Board The Senior Vice President of Information Technology (the "IT Officer"), along with the broader Information Technology function, is responsible for assessing and managing Aquestive's cybersecurity risk and informing senior management and the Audit Committee of the Board regarding cybersecurity risks and the prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Officer reports to the Chief Executive Officer and leads our cybersecurity program. Our IT Officer has been responsible for this function at Aquestive for 10 years and has over eleven years of experience in information security strategy and the management of cybersecurity risk. The internal Aquestive IT team has over fifteen years of technical experience, program management and architecture experience in managing cyber risk and information security.


text: The Audit Committee of the Board provides strategic oversight of Aquestive's cybersecurity matters, including risks associated with cybersecurity threats. The IT Officer briefs the Audit Committee on the effectiveness of Aquestive's cybersecurity program quarterly with a more in depth review done annually.


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats or incidents, including as a result of previous cybersecurity incidents, that we believe have materially impacted, or are reasonably likely to materially affect, the Company, including our business strategy, operational results, and financial condition.


text: We acknowledge the evolving nature of cyber threats to our business and industry. The Board oversees management's processes for identifying and mitigating cybersecurity risks to help align our risk exposure with our strategic objectives. To that end, cybersecurity risk management is integrated into the Company's overall enterprise risk management function. The Company utilizes a combination of processes and systems designed to assess, monitor, and respond to organizational cybersecurity risks in an effective manner across our operations. The cybersecurity risk management program includes regular assessments, providing a holistic view of our risk posture; this contributes to the ongoing improvement of our process, cybersecurity program, and security position.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Understanding the importance of cybersecurity, the Board maintains oversight of the cybersecurity risks and threats within the organization. Specifically, the Board has delegated authority to the Audit Committee to oversee risk management relating to cybersecurity. The Audit Committee is composed of members with various expertise including risk management, technology, and finance.


text: The Company's information security program is managed by a dedicated Vice President (VP) of Security Compliance and Risk Management (VP of Security), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, and who reports directly to the Chief Information Officer (CIO).


text: The Company's Security and Privacy Steering Committee meets on a regular basis and provides oversight of our security and privacy programs inclusive of defining the security strategy, reviewing risks and risk management strategies, and program performance. The committee is chaired by the VP of Security and comprises a broad selection of Senior Management leaders within the organization. This facilitates enterprise-wide collaboration in aligning cybersecurity objectives with organizational goals.


text: The VP of Security reports regularly to the CIO and the Security and Privacy Steering Committee. Further, the CIO provides regular reports to the Audit Committee and to the full Board. Reports include updates on our cyber risks and threats, projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Standards Based Program We use our best efforts to align our cybersecurity risk management with industry best practices, including processes to prevent, identify, assess, treat, monitor, and report on organizational risks. We design and assess our program utilizing tools such as the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these tools as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This covers Company owned and managed systems and technologies, along with those supplied to the organization by third parties.


text: Evolving Threats The program utilizes various resources, inclusive of third-party partners, to support an awareness and understanding of evolving cybersecurity threats, allowing the organization to be actively engaged in understanding and staying abreast of risks, and thereby supporting informed decision-making.


text: Our strategy includes a formal Incident Response Plan, designed to help the organization prepare for, respond to, and recover from confirmed or suspected cybersecurity or privacy incidents. Further, it evaluates and validates the effectiveness of our incident response capabilities, and allows for improvements as needed.


text: During the course of normal business operations, the Company collects, stores, and processes personal data. Being cognizant of the importance of protecting personal data and respecting the rights of individuals to have control over their personal information, the organization implements a data privacy program designed to comply with U.S. data privacy regulations and incorporates data privacy into its risk management program.


text: Training and Education Our enterprise-wide awareness and training program is utilized to mitigate risks by educating users on their role in combating security breaches, following good security practices, and maintaining awareness of security risks associated with their actions. This program includes mandatory and optional activities inclusive of online training, presentations, newsletters, blog posts, and simulation exercises.


text: Use of Third Parties Being cognizant of the complexity and dynamic nature of cybersecurity threats, the Company engages the services of various third-party experts, inclusive of managed security service providers, application and infrastructure cybersecurity assessors, consultants, and advisors. These engagements allow for the supplementing of our internal capabilities with specialized knowledge and expertise in the execution of cybersecurity strategic functions.


text: Third-Party Risks Given that risks associated with third parties can adversely impact an organization's overall security and risk posture, the Company implements a third-party risk management program to assess the security posture of third-party service providers. This includes security assessments prior to service engagement and ongoing monitoring.


text: The Company understands that the effective management of cybersecurity risks requires continuous assessment and improvement. Security benchmarking is a critical component to assess how well our security investments and processes compare with internal and external standards and objectives.


text: C. Management's Role and Expertise Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the VP of Security, who has over 16 years of dedicated experience in the field of cybersecurity across multiple industries. Their background includes extensive experience in cybersecurity program development, leadership, and risk management, which is instrumental in the execution of our cybersecurity strategies. Some specific responsibilities include overseeing our governance and compliance, risk management (identification, assessments, and treatment), and security and privacy awareness programs.


text: The Company's CIO possesses a wealth of information technology expertise and has served in various technology leadership roles across multiple industries. They are responsible for all technology systems, services, and solutions. The cybersecurity function reports directly into the office of the CIO.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Our SVP, Global Operations is responsible for monitoring the prevention, mitigation, detection, and remediation of cybersecurity incidents and reports the same to the Audit Committee of the Board each quarter. The Audit Committee has been delegated the responsibility for fulfilling the Board's oversight responsibilities regarding cybersecurity risk.

companyName: Silvaco Group, Inc.

ticker: SVCO


text: Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications, or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier, and partner information that we collect and store.


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our security information and event management system and team, in coordination with our edge security, monitor the events, analyze threats, and coordinate with our incident response team pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets and potential threats, assessing and prioritizing risks, employing various tools and techniques, including vulnerability scanning and penetration testing. Based on the risk assessment, appropriate security measures are implemented. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.


text: In the last three fiscal years, we have not experienced a cybersecurity incident which has been determined to be material, and the expenses we have incurred from cybersecurity incidents and threats were immaterial, including penalties and settlements, of which there were none.


text: We maintain a cybersecurity program, including policies and procedures designed to protect our systems, operations, and the data utilized and entrusted to us, including by us, from anticipated threats or hazards. We utilize a variety of protective measures as a part of our cybersecurity program. These measures include, where appropriate, access controls, patch management, identity verification and endpoint management software, employee cybersecurity awareness training programs, tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: MARKETWISE, INC.

ticker: MKTW


text: We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis.


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We provide regular training for our employees regarding cybersecurity threats and our security policies to equip our employees with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. In addition to our internal exercises to test aspects of our cybersecurity program, we periodically engage independent third parties to assess the risks associated with our information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of our information technology resources, including our employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes.


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, cash flows, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our Board, in coordination with the Audit Committee, oversees our cybersecurity program, including the management of risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks from our Chief Information Officer ("CIO"), which address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, incident response planning, remediation efforts, employee training and awareness (including the results of our annual cybersecurity training), and information security considerations arising with respect to our peers and third parties. On a regular basis, our Audit Committee discusses our approach to cybersecurity risk management with our CIO, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. The Board receives occasional updates from the Audit Committee and CIO on the effectiveness of our cybersecurity program. When appropriate, the Board also receives reports concerning the detection, mitigation and remediation of cybersecurity threats and incidents Our CIO has over 25 years of software engineering experience including over ten years of being responsible for MarketWise's cybersecurity. In coordination with our executive team, our CIO and our Senior Vice President of IT Operations work collaboratively across the Company to implement a program intended to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Our CIO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data results ("Information Systems and Data").

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: The Company's Chief Finance Officer ("CFO") and Associate Vice President of Information Technology ("AVPIT") help identify, assess and manage cybersecurity risk, including input from employees, and devote resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. The CFO and AVPIT identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example maintaining manual and automated tools, conducting scans of threats and actors, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, completing internal and external audits, using external intelligence feeds and completing third-party threat assessments.


text: We have processes and standards to address cybersecurity matters and mitigate material cybersecurity risk. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, encryption standards, access controls, disaster recovery/business continuity plans, incident detection and response, antivirus protection, remote access security, and multi factor authentication. All employees are required to complete cybersecurity trainings at least once a year.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our AVPIT along with management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.


text: The CFO and AVPIT, who has over thirty years of experience in information technology and has both a computer science and information science degree, a re responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. We support our information security program with external resources including cybersecurity software providers and advisors as needed.


text: We have a vendor management process to manage cybersecurity risks associated with our use of external providers that includes a risk assessment, reviews of vendor audits and reports, and we also impose certain contractual information security obligations on vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Board, as part of its general oversight function, participates in discussions with senior management and amongst themselves regarding cybersecurity risks. With the assistance of the Company's most senior IT manager, we review annually the cyber and data security risks of our overall IT environment. We assess cybersecurity risk and the overall environment which includes devices, IT systems, websites, social media accounts, manufacturing technology/systems and suppliers/vendors. The oversight from the Board includes material changes to relevant policies, procedures, employee training and elements of the overall environment, as necessary, and senior management provides an update to the Board on emerging cyber threats. The Board has access, as requested, to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of senior management, depending on the circumstances. Senior management works with the Company's cybersecurity incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's cybersecurity incident response plan includes reporting to the Board for certain cybersecurity incidents.


text: We face a number of cybersecurity risks in connection with our business. For more information about the cybersecurity risks we face, see the risk factor entitled "We and the third parties with whom we work rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems, or our data, could have a material adverse effect on our business, including by not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" in Item 1A- Risk Factors.


text: TIAA, on behalf of the Account, has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. The Account's business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA, with support from certain of its subsidiaries, manages the Account's day-to-day operations and has implemented a cybersecurity program that applies to the Account.

companyName: TIAA REAL ESTATE ACCOUNT


text: The Account depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. The Account relies on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with the Account's use of such entities.


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA, the Account, and other products, subsidiaries and affiliates of TIAA and their respective third party service providers.


text: This cyber risk management program is integrated into TIAA's overall risk management program. It involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Account relies. TIAA relies on its internal subject matter experts and external experts, as needed, including but not limited to cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, applicable to the Account and other products, subsidiaries, and affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Account in connection with its day-to-day commercial real estate, investment, and other operations.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from TIAA's Cybersecurity leadership regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Account.


text: Management's Role in Cybersecurity Risk Management TIAA's management, including its Chief Information Security Officer ("CISO"), is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Account. The CISO and cybersecurity leaders have significant expertise in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. In particular, the CISO holds an master of business administration (MBA) degree and a bachelor of science (BS) degree in computer science. He has several security industry certifications including the Certified Information Systems Security Professional (CISSP) and Certified Secure Software Lifecycle Profession (CSSLP) designations, and has held prior management positions in the technology space with Snap Finance, American Express, Visa and Paypal. Management of the Account is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Account, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Account are assessed on an ongoing basis, and how such risks could materially affect the Account's business strategy, operational results, and financial condition are regularly evaluated. TIAA maintained appropriate cyber security policies and procedures during the 12-month period covered by this report and there were no material cybersecurity issues that affected the Account. Cybersecurity risk remains heightened to the financial industry, including the Account, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Account's operations and performance. TIAA continues to invest in its cybersecurity program to protect against emerging threats, including threats against third parties and service providers.


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats. These processes are part of our overall enterprise risk management process and are part of our operating procedures, internal controls, and information systems. These risks include, among other things, operational risks; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer and employee information. • Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations. • Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to some employees based their roles. • Supplier risk assessments: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply-chain or who have access to our customer and employee data on our systems. Third-party risks are included within our risk management assessment program, as well as our cybersecurity-specific risk identification program. These considerations affect the selection and access to our systems, data, or facilities. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Third-party assessments: We have third-party cybersecurity companies engaged to periodically assess our cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks.


text: As part of the above processes, we regularly engage with consultants, auditors, and other third-parties, including reviewing our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: To date, risks from cybersecurity threats or incidents have not materially affected the Company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions we have taken and continue to take to reduce these risks and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee regularly reviews and discusses with management the strategies, processes, and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity. Our Senior Vice President (SVP) of Information Technology and other internal members of our technology team provide regular reports to the audit committee regarding the evolving cybersecurity landscape, including emerging risks, as well as our processes, programs, and initiatives for managing these risks. The audit committee, in turn, periodically reports on its review with the board of directors.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy processes are led by our SVP of Information Technology and Assistant Vice President (AVP) of IT Infrastructure and Security. Such individuals have collectiv ely over 50 years of work experience in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.


text: The SVP of Information Technology also presents at least annually to the Board an overview of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results of third-party assessments, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: We retain a chief information consultant and a third-party security management vendor to help identify, assess and manage our cybersecurity threats and risks. These partners identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example, automated tools, cybersecurity threat subscription services, threat report analysis, internal and external audits, and threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our security management partners work with our Chief Financial Officer to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, our Chief Financial Officer evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity software providers and penetration testing firms. These third-parties also provide application and hosting services. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments and audits for each vendor and a review of each such vendor's written security program.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our information security consultant and third-party managed service provider. Our information security consultant has over 40 years of experience in pharmaceutical information technology, including many years as a chief information officer.


text: Our Chief Financial Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our information security partners, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer and legal department. Our Chief Financial Officer works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have established an enterprise risk management program, with cybersecurity representing a relevant component of our overall approach to risk management. The cybersecurity portion of our risk management program shares common methodologies, reporting channels and governance processes that apply across the program to other legal, compliance, strategic, operational, and financial risk areas. In general, we seek to address cybersecurity risks through a data security framework that is focused on information classification and location, access and acceptable use controls, alerts and protections, vendor risk assessment, and backup and recovery. We engage third parties to perform assessments of our cybersecurity measures, including tabletop exercises, penetration testing, and other cybersecurity audits. As part of our cybersecurity risk management procedures, we also have a third-party cyber risk management process for service providers, suppliers, and vendors. Additionally, we provide regular, mandatory training for all employees regarding cybersecurity threats.

companyName: Foghorn Therapeutics Inc.

ticker: FHTX


text: As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident or other threats that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Our Board of Directors and Audit Committee oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. On at least an annual basis, the Board of Directors and Audit Committee receive presentations and reports on cybersecurity risks from our Vice President of Information Technology, which may address topics including our overall assessment of cybersecurity risks, compliance with cybersecurity policies and procedures, third-party test results, the current threat environment, and technological trends and information security considerations arising with respect to our peers in the biotechnology space. The Board and Audit Committee also receive ad hoc reporting as appropriate. Our Vice President of Information Technology, who reports to our Chief Legal Officer, is primarily responsible for assessing such risks. This individual has over 20 years of information technology and cybersecurity experience in the biotechnology industry.


text: Cyber Risk Management and Strategy We, under the oversight of the audit committee of our board of directors, have implemented and maintain a cybersecurity framework, informed by the Center of Internet Security, or CIS, cybersecurity framework. This includes policies, processes and technologies designed to minimize risks from cybersecurity threats. We maintain oversight of our third-party vendors with access to our information technology resources through the inclusion of contractual security requirements as appropriate.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: Our cybersecurity approach is designed to minimize risks from cybersecurity threats identified by internal stakeholders, threat intelligence providers, vulnerability management programs, and security management programs. Our internal team manages and maintains remediation strategies for identified risks, and reports on them periodically to senior leadership. We also require our employees to participate in monthly cybersecurity awareness trainings, which include phishing awareness simulations, to raise employee awareness of cybersecurity risks.


text: As appropriate, we assess our internal controls, including controls around our information technology systems and their impact on our financial statements or systems, through either independent audits or internal assessments with the assistance of third party resources.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. Our third party vendors may also experience threats and cybersecurity incidents from time to time. For more information, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Related to Cybersecurity Risks Our cybersecurity program and related operations and processes are directed by our Executive Director of Information Technology, whom we refer to as the IT Director. Currently, the IT Director role is held by an individual who has over 16 years of cybersecurity, information technology, and systems engineering experience. The Director of IT reports to our management – currently the Chief Business Officer.


text: The IT Director meets with the Chief Financial Officer, the Chief Compliance Officer, and the General Counsel periodically to monitor and review the outcomes of our cybersecurity program and to discuss and decide matters related to cybersecurity treatment strategy (including mitigations). The IT Director and the Chief Financial Officer provide periodic reports to the audit committee on cybersecurity risk management, and, quarterly, the Chief Financial Officer updates the audit committee of any material changes in the Company's cybersecurity framework or cybersecurity activity. The audit committee is responsible for reviewing and overseeing our risk management process, including risks from cybersecurity threats, pursuant to the audit committee charter. Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. In its risk oversight role, our board of directors has the responsibility to confirm that the risk management processes designed and implemented by management are appropriate and functioning as designed.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and bad actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. Moreover, the nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue.

companyName: HBT Financial, Inc.

ticker: HBT


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • internal resources who are responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect, alert on, respond to, and help mitigate cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments, and other procedures which identify potential weaknesses in our systems and help validate and improve internal processes and tooling; and • periodic cybersecurity training for our workforce.


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our lines of business and geographic locations.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition. We continue to evolve our controls to mitigate these threats as effectively as we can reasonably foresee them occurring.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Officer. Our current Chief Information Officer has over 20 years of technology experience, including 16 years in Banking.


text: In addition, our board of directors is responsible for the oversight of risk management. In that role, our board of directors, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receive reports from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents. These reports are delivered at least quarterly, with additional information and trainings provided at least twice per year.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to the our cybersecurity policies, standards, processes and practices, which are integrated into our overall risk management system.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: We take a risk-based approach to cybersecurity aligned with National Institute of Standards and Technology (NIST) Cybersecurity Framework principles and have implemented controls throughout our operations that are designed to address cybersecurity threats and incidents. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.


text: Our cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. Our cybersecurity program and policies are operated by a dedicated cybersecurity operations team in conjunction with our enterprise Risk Management and Compliance program.


text: Our cyber risk management program identifies, tracks, escalates, remediates, and reports cyber related risks throughout the Company. These risk areas include internal, product, vendor, supply chain, and external services utilized across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to ensure ongoing mitigation and tracking. We utilize internal and external resources, including leading third party providers in the cybersecurity prevention, detection and monitoring space, to monitor for cybersecurity threats to our systems and networks and to understand the broader threat environment.


text: Our cybersecurity strategy is guided by prioritized risk, identified areas for improvement based on the NIST Cybersecurity Framework, and emerging business needs. Cybersecurity risks are continually monitored and shared with the executive leadership team on a quarterly basis. We maintain a global incident response plan, coupled with a global continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes designed to support our teams, our senior leadership, and the Board. This escalation process also includes cross-functional materiality determinations and applicable reporting requirements.


text: Our cybersecurity operations team manages all facets of cybersecurity monitoring, coordinating with managed services security providers and internal analysts across the Company. All employees are provided cybersecurity awareness training, which includes topics on our policies and procedures for reporting potential incidents. Our cybersecurity team regularly evaluates emerging risks, regulations, and compliance matters and updates applicable policies and procedures accordingly.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to "Part I, Item 1A. Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company, including the risk factor captioned "Cybersecurity attacks or security breaches or incidents impacting our systems or data could adversely affect our ability to operate, could result in personal information and our proprietary information being lost, stolen, made inaccessible, improperly disclosed or misappropriated and may cause us to be held liable or subject to regulatory penalties and sanctions and to litigation (including class action litigation), which could have a material adverse effect on our reputation and business."


text: The Board, directly and through its committees, oversees our risk management process, including cybersecurity risks and regularly receive presentations and reports from management. Pursuant to the Risk Management and Compliance Committee Charter, the Risk Management and Compliance Committee of the Board provides compliance oversight of our risk assessment and risk management policies, which include cybersecurity, and receives regular reports and updates on the steps management has taken to monitor and mitigate such exposures and risks.


text: Our Chief Information Security Officer ("CISO"), in coordination with our Chief Technology Officer, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 25 years of experience managing robust security programs, including in heavily regulated environments such as financial services. The CISO possesses extensive experience in information security, risk management, and technology governance, with a strong background in both strategic leadership and technical security operations. The CISO presents to the Risk Management and Compliance Committee on a bi-annual basis concerning our cybersecurity program.


text: The Company recognizes the security of our banking operations is essential to protecting our customers, maintaining our reputation, and preserving the value of the Company. The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Enterprise Risk Management Program establishes policies and procedures for assessing the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program including its cybersecurity risk management program: Federal Financial Institutions Examination Council Cybersecurity Assessment Tools and GLB Act and regulations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach focused on the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents that may occur.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Enterprise Risk Management Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the section titled "Cybersecurity Governance," the Board Risk Oversight Committee has delegated to senior management responsibility for managing the Enterprise Risk Management Program. Senior management carries out this mandate through the Strategic Initiatives and Board Risk Oversight Committees. To maintain alignment and appropriate insight regarding information security activities, a bi-weekly operational committee provides general program insight. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, assessing, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management. • Security Competencies: The Company has security competencies and tools designed to evaluate security risks and to protect the confidentiality, integrity and availability of our information systems and data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense and Incident Response Plan: The Company utilizes sophisticated security monitoring and detection tools for continuous monitoring of our information systems 24 hours per day, seven days per week. The Company utilizes third-party tools and solutions to actively deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. We also receive the latest cybersecurity alerts and threat intelligence from government agencies and information sharing and analysis centers. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidance on our response to incidents by focusing on the coordination of personnel, policies, and procedures to ensure incidents are detected, analyzed and managed. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven by risk factors established by the Third-Party Risk Management Program. The process provides awareness and collaboration across all internal teams including Information Technology and Risk Management. A review process is conducted on new or significantly changed key third parties, to ensure certain cybersecurity baseline requirements are met and cybersecurity incidents are appropriately disclosed. This process is aimed at advocating for appropriate standards and controls, based on risk factors, to secure the third parties' information systems, and to ensure the third parties have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness to better equip Company personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices. This training is supplemented with annual required third party information security training. Additionally, the Company conducts monthly email security awareness testing, with follow-up training assigned when deemed necessary.


text: The Company leverages continuous monitoring and regular risks assessments to identify the Company's current and potential cybersecurity risks. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board Risk Oversight Committee.


text: The Company engages third parties on a regular basis to assess, test and assist with the implementation of our cybersecurity program to detect and manage cybersecurity risks, including but not limited to third parties who assist with monitoring our information security systems and auditors who assist with conducting penetration tests.


text: The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board Risk Oversight Committee reviews and approves the Information Security Policy, which includes the Company's cybersecurity risk management program. The Board of Directors receives regular presentations and updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, risk and vulnerability assessments, independent audit reviews, and technological trends. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full board of directors discusses the Company's approach to cybersecurity risk management.


text: The Information Security Officer, under the guidance of our Chief Risk Officer and Operational Risk Manager, works collaboratively across the Company to implement a program designed to protect the Company's information systems and data from cybersecurity risks. The Information Security Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents in accordance with the Company's Incident Response Plan and Business Continuity Plan, and reporting incidents to appropriate personnel at the Company in accordance with the Incident Response Plan. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The Information Technology and the Operational Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Information Security Officer and Chief Information Officer and ultimately the Board Risk Oversight Committee when appropriate. The Information Security Department has over three decades of experience in managing Information Security and Cybersecurity programs at financial institutions. The Information Security Officer holds the Certified Information Security Manager Certification and is supported by additional team members with extensive backgrounds in cybersecurity and related fields.


text: Notwithstanding our efforts at cybersecurity, the Company cannot guarantee that it will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A., Risk Factors – Risks Related to Our Business.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and proprietary information. Our cybersecurity risk management program includes a multi-point cybersecurity incident response plan.

companyName: System1, Inc.

ticker: SST


text: First, we have designed and assessed our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our businesses and technology infrastructure.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that we evaluate and address on a regular basis based on a risk-weighted determination.


text: Our cybersecurity risk management program includes the following elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing: (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external experts, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • cyber/technology errors & omissions insurance; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and assessment of materiality against external reporting requirements; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.


text: There can be no assurance that our cybersecurity risk management program and evaluation and security processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in adequately protecting our systems, technology infrastructure and proprietary information. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors".


text: We have not identified specific risks from known or other broadly publicized cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors".


text: Our Board of Directors (the "Board) considers evaluating and proactively addressing cybersecurity risk as part of its risk oversight function and has delegated to the Board's Nominating and Corporate Governance Committee (the "Committee") oversight of cybersecurity and other information technology risks facing us and our businesses. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on the cybersecurity risks that we evaluate and which we may face in the future. In addition, management updates the Committee as necessary regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity oversight and assessment. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO and Director of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The information technology team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the I.T. environment.


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to team members, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage such material risks and to safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's and its customers' data, and maintain the trust and confidence of our customers, business partners and team members.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: The Board of Directors is actively involved in oversight of the Company's risk management framework and the Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration attempts to ensure that cybersecurity considerations are an integral part of decision-making processes throughout the Company. The Company's risk management team works closely with the Company's IT department to continuously evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures that are designed to provide for the prompt escalation of any cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive appropriate information in a timely manner.


text: Due to the complexity and evolving nature of cybersecurity threats, the Company has engaged from time-to-time external experts, including cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. The Company engages these third-parties to conduct regular audits, threat assessments and consultation on security enhancements. These interactions are intended to enable the Company to leverage specialized knowledge and insights, in an attempt to ensure its cybersecurity strategies and processes remain at the forefront of industry practices.


text: In furtherance of assessing, identifying, and managing material cybersecurity risks; the Company: • Employs advanced technology solutions, such as proactive detection tools, to safeguard our assets and identify threats within its environment. • Conducts routine cyber education and awareness training sessions to empower team members with the necessary knowledge and cultivate a strong security culture across the organization. • Regularly assesses our cybersecurity program against the NIST Cybersecurity Framework, using the findings to develop action plans and track progress to completion. • Organizes tabletop exercises and drills to simulate cyber incidents, enhancing its incident response and recovery capabilities. • Analyzes internal and external cybersecurity incidents and threat intelligence to assess their relevance to its environment and industry, crafting actionable plans accordingly. • Manages an enterprise-wide disaster recovery governance program, including cybersecurity-related standards and compliance procedures. • Performs regular cybersecurity-related disaster recovery testing to ensure the recoverability of its critical systems, supporting business continuity across various lines. • Fosters integration between business units and corporate divisions with its internal cybersecurity team, embedding cybersecurity requirements into operational environments and influencing strategic decisions, budgeting, and processes (e.g., Security by Design). Additionally, senior management, executives, and the Board of Directors consistently review financial planning processes concerning cybersecurity initiatives.


text: Additionally, the Company is aware of the risks associated with third-party service providers, it implements stringent processes to oversee and manage these risks. The Company conducts security assessments of third-party technology providers before engagement and maintains ongoing monitoring to ensure compliance with Company cybersecurity standards. The monitoring includes assessments (e.g., reviewing vendor cybersecurity related attestation and disclosures (SOC 2 Type 2, etc.)) by the Company's Senior Vice President and Chief Information Officer ("CIO") and on an ongoing basis by its security engineers.


text: The Company's CIO is the member of the Company's management team primarily responsible for assessing, monitoring and managing the Company cybersecurity program. The Company's CIO has over 20 years of experience in the field of technology and security including experience as an enterprise CIO, as well as consulting experience advising organizations on their technology and risk profiles. The Company believes its CIO's in-depth knowledge and experience are instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies.


text: The Company's CIO oversees the day-to-day implementation of the Company's cybersecurity risk management programs, tests its compliance with standards, remediates known risks, and leads its employee cybersecurity training program. The CIO is tasked with keeping informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, in an attempt to assist in effectively preventing, detecting, mitigating, and remediating cybersecurity incidents. The CIO implements and oversees processes for the regular monitoring of the Company's information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is responsible for implementing the Company's incident response plan to mitigate the cybersecurity incident's immediate impact, implement long-term strategies for remediation, and prevent future incidents.


text: The CIO regularly informs the Company's Executive Vice President and Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") of material aspects related to cybersecurity risks and incidents regarding the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. Notwithstanding that fact, the full Board of Directors has been designated as primary responsible for oversight of the Company's cybersecurity risk management. As discussed below, management reports to the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks regarding financial statements or financial statements reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.


text: The Board of Directors is composed of members with diverse expertise, including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively. Further, certain members of the Board of Directors are National Association of Corporate Directors ("NACD") CERT Certified in cybersecurity oversight.