text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share.


text: Our Board of Directors, the Audit Committee and the Cyber Committee, which is chaired by the Chief Executive Officer and staffed by the IT Director, Chief Financial Officer, Corporate Controller and other management employees, are responsible for overseeing cybersecurity risks and risk management. The Board has assigned oversight responsibility for cybersecurity to the Audit Committee, which is in regular communication with management concerning cybersecurity threats and incidents. The Audit Committee reviews management assessment of cyber controls, control testing and outcomes. The Audit Committee is responsible for keeping the Board informed of significant cybersecurity developments including incidents which might potentially have a material effect on the Company. The Cyber Committee is responsible for evaluating cyber threats, the potential effect on operations and scope of the threat. Threats or incidents which the Cyber Committee has judged to have potentially material consequences will be communicated to the Audit Committee. A meeting of the full Board of Directors, including the Audit Committee, will be convened within 48 hours of the Cyber Committee assessment. If the Board determines that the threat or incident is material, Form 8-K will be finalized and filed within four days following the determination, as required under SEC rules. The Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: NeuroMetrix, Inc.

secItem: Item 1C


text: The Company employs a comprehensive, cross-departmental approach to continuously assess, identify, and manage potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the information technology ("IT") security team, which is led by our Chief Information Security Officer ("CISO"), the Information Security Steering Committee ("ISSC"), which is chaired by our CISO and comprised of executive and senior representatives from key corporate functions as overseen by the Board of Directors, primarily through the Audit Committee. The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management program and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: Our cybersecurity risk management program categorizes cybersecurity risks into five areas: identify, protect, detect, respond, and recover. We regularly assess the cybersecurity threat landscape, employing a layered cybersecurity strategy that emphasizes prevention, detection, and mitigation through a variety of technical and operational measures. As a part of our cybersecurity risk management program, our information security program is tailored to address identified risks, while aligning with pertinent business requirements.


text: We foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training to enhance awareness and readiness against potential cyber threats. Certain roles require additional role-based, specialized cybersecurity training, such as tabletop exercises to ensure proactive preparation and effective coordination in the event of a security incident. We engage a third-party to conduct annual tabletop exercises in order to rehearse our incident response plan, as well as to identify and prioritize opportunities for improvement within our cybersecurity program and associated security controls, through a customized simulation specifically tailored to our current environment, processes, and procedures. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. Our IT security team reviews and updates such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.


text: We continually seek to update our IT security, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts to evaluate the efficacy of our security measures. We engage reputable third parties to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness. Risks from cybersecurity threats, including as a result of previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, have not materially affected, and are not currently viewed as reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the ISSC and the Audit Committee. Our CISO possesses over 24 years of experience in various technology, cybersecurity operations, and engineering roles, holds a bachelor's degree in computer information science and a master's degree in technology management, earned a CISO Certificate from Carnegie Mellon University, and is ISC2 CISSP certified.


text: Other key members of management assist our CISO in the oversight of cybersecurity risk management through their membership in the ISSC, which is chaired by our CISO and is comprised of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, President of Direct-to-Consumer, and Global Digital, Privacy Counsel, and our Vice President of Internal Audit. The ISSC reviews and discusses comprehensive quarterly and annual reports from our CISO and the IT security team in order to provide cooperation, collaboration, and consensus driven information security guidance to the IT department and the Company as whole.


text: We have also established an Incident Response Team (the "IRT"), which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed, to identify and assess security incidents, including the impact and severity of such incidents. Upon the identification of a security incident, the IRT performs an impact analysis and then determines the appropriate course of action, which may include escalation to the ISSC. Upon consultation with the ISSC and consideration of the relevant risks, the IRT will determine whether the incident should be communicated to the Audit Committee of the Board of Directors.


text: Board of Directors The Audit Committee of the Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Audit Committee reviews quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, any newly-identified risks, existing projects, and key performance insights and engages in discussions with management based on such reports and other recent developments.


text: The Company maintains an Information Security Program which is designed to ensure the confidentiality, integrity, and availability of all data and systems across the organization. We have developed a system of processes and controls to mitigate risks and respond effectively to security incidents.

companyName: Eagle Bulk Shipping Inc.


text: Key components of our Information Security Program include: • Risk Management: We conduct regular risk assessments to identify, evaluate, and prioritize potential threats and vulnerabilities. Based on our understanding of the risk landscape relevant to the Company, we have implemented targeted controls and allocated resources to mitigate risks to an acceptable level. • Policies and Procedures: Our Information Security Program is supported by a set of clear and enforceable policies and procedures. These documents outline standards for data handling, access control, password management, incident response, and other critical security practices. We regularly review and update our policies and procedures to ensure alignment with industry best practices and regulatory requirements. • Access Control: We enforce strict access controls, which include role-based least-privileged access, strong authentication methods and regular access reviews to limit system and data access to authorized personnel only. • Security Awareness Training: We believe that our employees are our first line of defense against cyber threats. We provide comprehensive security awareness training programs to educate staff about common risks, phishing attacks, social engineering tactics, and best practices for maintaining a secure information technology environment. We also provide security updates and alerts to keep our employees informed of active and emerging external cybersecurity threats. • Technical Controls: Our Information Security Program incorporates a layered approach to technical controls. This includes firewalls, intrusion detection and prevention systems, endpoint protection, encryption mechanisms, and continuous monitoring tools to detect and respond to security incidents in real-time. • Incident Response and Business Continuity: Despite our proactive measures, we recognize that security incidents may still occur. Therefore, we maintain a robust incident response plan, detailing procedures for detecting, analyzing, containing, and recovering from security breaches. Additionally, we have comprehensive business continuity and disaster recovery plans in place to ensure minimal disruption to our operations in the event of a cybersecurity incident. • Compliance and Auditing: Our Information Security Program is designed to comply with relevant regulations and industry standards. We undergo regular internal and external audits to assess our adherence to these requirements and demonstrate our commitment to maintaining a strong security posture.


text: Our Information Security Program is led by our Director of Global Information Technology, who has over 20 years of relevant educational and technical experience. The Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. We have integrated cybersecurity risk into our disclosure controls and procedures. The Audit Committee of the Board of Directors regularly reviews and discusses with management risks related to our information systems, information security, data privacy and cybersecurity risks and the Company's risk assessment and risk management programs and the steps management has taken to monitor and control such exposures. The Audit Committee also receives, at least quarterly, updates from the Director of Global Information Technology and senior management regarding material information regarding the Company's information systems, information security, data privacy and cybersecurity.


text: We continuously monitor emerging threats, evaluate new technologies, and refine our security practices to manage evolving risks. Through regular assessments, audits, and feedback mechanisms, we strive for continuous improvement in our Information Security Program to better protect our assets and maintain the trust of our stakeholders.


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. However, we are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions. Cyber intrusions require a significant amount of time and effort to assess and remedy, and our incident response efforts may not be effective in all cases. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors - Cybersecurity incidents or other security breaches involving our computer systems or the systems of one or more of our vendors could materially and adversely affect our business.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the International Organization for Standardization ("ISO") 27001 Framework and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such standards, including the ISO 27001 Framework, as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: FuboTV Inc.

ticker: FUBO


text: Our cybersecurity risk management program is supported by both management and our Board of Directors, and is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, which are then used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our management team and Audit Committee on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • periodic assessment and deployment of security tools and technical safeguards designed to protect our information systems from cybersecurity threats; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • controls designed to identify and manage cybersecurity threats associated with our use of third-party service providers, suppliers and vendors with respect to our critical systems and data.


text: We have not identified any cybersecurity threats, including as a result of prior incidents, that as of the date of this Annual Report have materially affected us, or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. However, there can be no guarantee that such controls, policies and procedures will be fully implemented and properly followed in every instance, or that those investments or policies and procedures will be effective. We therefore can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors—Risks Related to Privacy, Consumer Protection and Cybersecurity—Any significant interruptions, delays or discontinuations in service or disruptions in or unauthorized access to our information technology systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, including subscriber and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management and our internal cybersecurity personnel, including our Senior Director of Cybersecurity, on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including our Chief Financial Officer, Chief Legal Officer and Chief Technology Officer, is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program. The management team has broad experience in overseeing and managing enterprise risk, governance and compliance functions, and supervises both our internal cybersecurity personnel, including our Senior Director of Cybersecurity who reports directly to our Chief Financial Officer, and external cybersecurity consultants retained from time to time, in each case who have broad cybersecurity experience and expertise, including in threat assessments and detection, mitigation technologies, training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us from time to time to review and assess our cyber programs and policies; and alerts and reports produced by security tools deployed in the IT environment. In addition, our Chief Financial Officer, Chief Technology Officer and Chief Legal Officer are members of our internal Cybersecurity Governance Committee, chaired by the Senior Director of Cybersecurity, a management committee comprised of leadership from primary corporate functions including Finance, Human Resources, Information Technology, Engineering, Internal Audit and Legal, which meets quarterly to drive alignment on security decisions across the Company, including reviewing security performance metrics, identifying security risks, and assessing the status of approved security enhancements.


text: Aquestive's cybersecurity program is built on three key pillars: Governance, Process, Compliance and Audit. While we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, and results of operations, Aquestive's cybersecurity program is built upon a set of policies, procedures, and standards supported by training and awareness. The cybersecurity team has significant experience in managing cybersecurity programs and has engaged with a MSSP to deploy state of the art cybersecurity technologies and gather threat intelligence and cyber risk trends. The cybersecurity program is executed with the MSSP which provides active threat monitoring, risk assessment and incident response capabilities to timely assess and address any material cyber risk that could impact our business operations. The Senior Vice President of Information Technology ("IT Officer"), along with the broader Information Technology function, is responsible for assessing and managing Aquestive's cybersecurity risk and informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: Role of Management/Board The IT Officer reports to the Chief Executive Officer and leads our cybersecurity program. Our IT Officer has over ten years of experience in information security strategy and the management of cybersecurity risk. The internal Aquestive IT team has over fifteen years of technical experience, program management and architecture experience in managing cyber risk and information security. In addition, the Audit Committee of the Board oversees Aquestive's cybersecurity risk exposures. The IT Officer briefs the Audit Committee on the effectiveness of Aquestive's cybersecurity program quarterly with a more in depth review done annually. In addition, cybersecurity risks are also reviewed as part of our overall Enterprise Risk Management program. We have not encountered any cybersecurity threats or incidents that have had a material impact on our business.


text: We are a global bioscience company dedicated to healthy aging. In the ordinary course of our business, we may collect, process, store and transmit proprietary, confidential and sensitive information, including personal information (including health information), intellectual property, trade secrets, and proprietary business information owned or controlled by ourselves or other parties. We use our data centers and our networks, and those of third parties, to store and access our proprietary business and other sensitive information. We rely upon third parties service providers and technologies to operate critical business systems to process confidential and personal information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, employee email, and other functions. We have established cybersecurity risk management policies and procedures aimed at safeguarding the confidentiality, integrity, and availability of our critical systems and information, including those involving third-party service providers. Further, we are actively working to enhance our policies and procedures into a more comprehensive cybersecurity risk management program, our current measures are designed to address cybersecurity risks effectively. Our cybersecurity risk management policies and procedures include the ChromaDex Incident Management Plan.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: We design and assess our policies and procedures based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF framework). This does not imply that we follow or meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. For example, we periodically perform independent third-party security audits and assess potential risks.


text: Our cybersecurity risk management policies and procedures are integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: –risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: –a security team, led by our Vice President of IT (VP of IT), principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) responses to cybersecurity incidents;


text: –the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; –cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: –a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and –a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function. In connection with the Audit Committee's oversight of the Company's risk management, the Audit Committee reviews with management, at least annually, the Company's cybersecurity risk exposure and the steps management has taken to monitor or mitigate such exposure, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes. In addition, management will update the Audit Committee and the full Board, as necessary, regarding cybersecurity incidents, that we may experience.


text: Our management team, including our VP of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management policies and procedures and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our VP of IT, who has experience across technology-enabled growth, information security, infrastructure, operations and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and bad actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. Moreover, the nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue.

companyName: HBT Financial, Inc.

ticker: HBT


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • internal resources who are responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • periodic cybersecurity training for our workforce.


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our lines of business and geographic locations.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Officer. Our current Chief Information Officer has over 20 years of technology experience, including 15 years in Banking.


text: In addition, our board of directors is responsible for the oversight of risk management. In that role, our board of directors, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receive reports from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents. These reports are delivered at least quarterly, with additional information and trainings provided at least twice per year.


text: As a cloud-based digital agreements and identity and authentication security solutions provider servicing customers in regulated industries, cybersecurity risk management is an important part of our identity. We maintain an enterprise cybersecurity risk management program designed to assess, identify, and manage material cybersecurity risks within our corporate information security environment and the systems we develop and operate for the benefit of our customers. Our cybersecurity risk management program is based upon best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements.

companyName: OneSpan Inc.

ticker: OSPN


text: We maintain security policies, standards, and processes that apply across our operations and that are approved by management, communicated to our personnel, and reviewed on an annual basis. We provide a global security awareness education program that includes mandatory security and privacy awareness training for all personnel, regular phishing identification exercises, focused training opportunities for particular roles, and incident response training for key individuals.


text: Risk Assessment and Safeguards. We conduct regular assessments of risks and vulnerabilities to the confidentiality, integrity, and availability of data in our systems, and we implement safeguards to reduce these risks and vulnerabilities to a reasonable and appropriate level. For internal information systems and assets, we conduct regular internal reviews, employ continuous security monitoring, and conduct periodic independent reviews of the key components of our security program. For customer-facing products and services, in addition to internal reviews and testing, we undergo external reviews and penetration testing using an independent third party provider. Our cloud platforms for SaaS solutions are audited annually by external independent auditors who review our platforms against the Service Organization Controls ("SOC") 2 and ISO 27001, 27017 and 27018 standards, and some of our Digital Agreement products are available on a FedRAMP compliant platform. Some of our products are certified under specific technical standards or industry guidelines, such as FIPS 140-2 and FIDO. Our Digipass authentication fulfillment services are also audited annually by external independent auditors against the SOC 2 standard. We conduct self-assessment activities for those standards or regulations that are not covered by the external auditors, such as the General Data Protection Regulation in Europe. Additionally, we periodically engage third party consultants to assist with identifying, assessing, and/or managing cybersecurity threats.


text: Incident Management. We have a documented incident response plan for identifying and responding to cybersecurity incidents that focuses on isolating, containing, mitigating, and eradicating the threat as quickly as possible. In the event of a cybersecurity incident, we will follow a documented incident escalation procedure. For a discussion of whether any cybersecurity risks have, or are likely to materially affect us, please see 1A, Risk Factors, for a discussion of identified cybersecurity risks.


text: Third Party Risk Management. Our vendor security risk management program covers vendors that require connectivity to our systems or access to confidential information. We utilize a trust intelligence platform for managing data privacy and data governance which includes third party risk management. Security reviews are performed periodically, based on vendor criticality, to identify potential security issues with the vendor systems or practices. New vendor contracts are reviewed by our legal and security teams, as appropriate, to confirm that security and data protection are appropriately addressed.


text: Material Cybersecurity Incidents. While we have experienced several security incidents in the past, we have not experienced any material cybersecurity incidents for the fiscal year ended December 31, 2023. We do not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations or financial condition.


text: Our Board is primarily responsible for overseeing the assessment and management of our risk exposure, including the balance between risk and opportunity and the totality of risk exposure across the organization. The Audit Committee oversees the company's cybersecurity risks and exposures. We operate our security program under a global Information Security Charter approved by the Audit Committee, and the Audit Committee receives security updates and information about cybersecurity risks from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") at least quarterly. Our Board generally reviews the company's overall risk management program at least annually, including the corporate insurance program which includes our cybersecurity insurance policy. We maintain an Information Security Steering Committee which is composed of key senior leaders who oversee the corporate information security program and our cybersecurity posture. Cybersecurity threats with the possibility of heightened criticality are escalated to a management team comprised of C-level executives and legal department representatives.


text: The CIO leads our global information technology organization and has nearly 30 years of information technology leadership experience, including acting as CIO at two cloud-based technology providers. The Senior Vice President of Research and Development has more than 25 years of information technology experience, including at another publicly traded technology company. Our CISO reports to the CIO and is responsible for leading our information security organization and overseeing our information security program. The CISO has over 20 years experience in information technology and security, including serving as Chief Information Security Officer at another cloud-based technology provider. Team members who support our cybersecurity risk management program have relevant education and experience in the fields of cybersecurity, risk management, security architecture, data protection, application security, audit, compliance, incident response, identity governance and governance of enterprise information technology.


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Vertex Energy Inc.


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things have undertaken the following measures: • Advanced Endpoint Protection • Disparate Firewall Security technology between the edge and internal networks • Live monitoring for user permission changes; • Live monitoring for suspicious file access or activities; • Advanced intrusion detection and automated threat response; which monitors internal activities in addition to external traffic; • Enrolled in Oil and Gas ("O&G") threat intelligence service; • Enrolled in US Cybersecurity & Infrastructure Security Agency ("US CISA") data hygiene service; and • Enrolled in FBI InfraGard threat intelligence. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "The Company's information technology systems could suffer interruptions, failures or breaches and our business operations could be disrupted adversely effecting results of operations and the Company's reputation" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management, which includes that of the Company. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.


text: We have established an enterprise risk management program, with cybersecurity representing a relevant component of our overall approach to risk management. The cybersecurity portion of our risk management program shares common methodologies, reporting channels and governance processes that apply across the program to other legal, compliance, strategic, operational, and financial risk areas. In general, we seek to address cybersecurity risks through a data security framework that is focused on information classification and location, access and acceptable use controls, alerts and protections, vendor risk assessment, and backup and recovery. We engage third parties to perform assessments of our cybersecurity measures, including tabletop exercises, penetration testing, and other cybersecurity audits. As part of our cybersecurity risk management procedures, we also have a third-party cyber risk management process for service providers, suppliers, and vendors. Additionally, we provide regular, mandatory training for all employees regarding cybersecurity threats.

companyName: Foghorn Therapeutics Inc.

ticker: FHTX


text: As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident or other threats that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Our Board of Directors and Audit Committee oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. On at least an annual basis, the Board of Directors and Audit Committee receive presentations and reports on cybersecurity risks from our Vice President of Information Technology, which may address topics including our overall assessment of cybersecurity risks, compliance with cybersecurity policies and procedures, third-party test results, the current threat environment, and technological trends and information security considerations arising with respect to our peers in the biotechnology space. The Board and Audit Committee also receive ad hoc reporting as appropriate. Our Vice President of Information Technology, who reports to our Chief Strategy and Business Operations Officer, is primarily responsible for assessing such risks. This individual has over 20 years of information technology and cybersecurity experience in the biotechnology industry.


text: We maintain a cybersecurity program, including policies and procedures designed to protect our systems, operations, and the data utilized and entrusted to us, including by us, from anticipated threats or hazards. We utilize a variety of protective measures as a part of our cybersecurity program. These measures include, where appropriate, access controls, patch management, identity verification and endpoint management software, employee cybersecurity awareness training programs, tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: MARKETWISE, INC.

ticker: MKTW


text: We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis.


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We provide regular training for our employees regarding cybersecurity threats and our security policies to equip our employees with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. In addition to our internal exercises to test aspects of our cybersecurity program, we periodically engage independent third parties to assess the risks associated with our information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of our information technology resources, including our employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes.


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, cash flows, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Our Board, in coordination with the Nominating and Governance ("Nom Gov") Committee, oversees our cybersecurity program, including the management of risks from cybersecurity threats. The Nom Gov Committee receives regular presentations and reports on cybersecurity risks from our Chief Information Officer ("CIO"), which address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, incident response planning, remediation efforts, employee training and awareness (including the results of our annual cybersecurity training), and information security considerations arising with respect to our peers and third parties. On a regular basis, our Nom Gov Committee discusses our approach to cybersecurity risk management with our CIO, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. The Board receives occasional updates from the Nom Gov Committee and CIO on the effectiveness of our cybersecurity program. When appropriate, the Board also receives reports concerning the detection, mitigation and remediation of cybersecurity threats and incidents Our CIO has over 25 years of software engineering experience including over ten years of being responsible for MarketWise's cybersecurity. In coordination with our executive team, our CIO and our Senior Vice President of IT Operations work collaboratively across the Company to implement a program intended to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Our CIO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board.


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats. These processes are part of our overall enterprise risk management process and are part of our operating procedures, internal controls, and information systems. These risks include, among other things, operational risks; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer and employee information. • Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations. • Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to some employees based their roles. • Supplier risk assessments: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply-chain or who have access to our customer and employee data on our systems. Third-party risks are included within our risk management assessment program, as well as our cybersecurity-specific risk identification program. These considerations affect the selection and access to our systems, data, or facilities. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Third-party assessments: We have third-party cybersecurity companies engaged to periodically assess our cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks.


text: As part of the above processes, we regularly engage with consultants, auditors, and other third-parties, including reviewing our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: To date, risks from cybersecurity threats or incidents have not materially affected the Company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions we have taken and continue to take to reduce these risks and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity. Our Chief Information Officer (CIO) and other internal members of our technology team provide regular reports to the audit committee regarding the evolving cybersecurity landscape, including emerging risk, as well as our processes, program and initiatives for managing these risks. The audit committee, in turn, periodically reports on its review with the board of directors.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy processes are led by our CIO, VP Information Technology, and Manager of Security. Such individuals have collectively over 50 years of work experience in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.


text: The CIO also presents at least annually to the Board an overview of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results of third-party assessments, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: As SandRidge has increasingly relied on information technology systems and networks in connection with our business activities, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: SandRidge has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with IT professionals to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. The underlying controls of our cybersecurity risk management are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").


text: The following is a brief list of some of the cybersecurity risk management tools we employ to identify, assess and manage threat risks: –Third party system and network scanning tools that identify or automatically block potential cybersecurity threats; –Live 24-hour monitoring of corporate and field operations IT networks for cybersecurity threats; –Mandatory annual employee cybersecurity awareness training program that includes phishing simulations and other microlearning courses; –Monthly IT and cybersecurity meetings with management and IT professionals; –Completion of annual IT network cybersecurity assessment and vulnerability scan;


text: –Segregation of our financial data records, that are stored on remote servers, separate and apart from our corporate office network with backups stored in different geographical regions in the United States.


text: Recognizing the complexity and evolving nature of cybersecurity threats, SandRidge engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes focus on industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Because we are aware of the risks associated with relying on third-party service providers, to, among other things, estimate quantities of oil and natural gas reserves, analyze seismic and drilling information, process and record financial and operating data and communicate with employees and third parties, SandRidge implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes assessments by our internal audit and IT professionals. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Incidents and Threats We have in the past experienced, and expect to continue to confront, cybersecurity incidents and cybersecurity threats from hackers and other third parties. Although such prior incidents have not had a material adverse impact on our operations or financial performance, there can be no assurance that we will be successful in preventing cybersecurity incidents or successfully mitigating their effect on our Company. Any cybersecurity incident could have a material adverse effect on our reputation, competitive position, business, financial condition and results of operations.


text: Additionally, although out of our control, cybersecurity incidents affecting oil and natural gas distribution systems maintained by third parties, or the networks and infrastructure on which they rely, could delay or prevent delivery of our production to markets, which could, in turn, have a material adverse effect on our business, financial condition and results of operations.


text: For additional information regarding the risks we face from cybersecurity threats, please see the section entitled "Item 1A. Risk Factors—Cybersecurity incidents or other failures in telecommunications or IT systems could result in information theft, data corruption and significant disruption of our business operations."


text: Governance – Board Oversight and the Role of Management The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee ensures effective oversight by reviewing reports on information security and cybersecurity from the Director of Internal Audit at least annually.


text: Primary responsibility for assessing and integrating within enterprise risk management of our cybersecurity risks rests with our Director of Internal Audit, who oversees our governance programs, tests our compliance with standards, remediates known risks, and coordinates our employee training program.


text: The Director of Internal Audit, in their capacity, regularly informs the Chief Executive Officer ("CEO"), the Chair of the Audit Committee, and other members of management of aspects related to cybersecurity risks and incidents. This ensures that the appropriate levels of management are kept abreast of the cybersecurity posture and potential risks facing SandRidge. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Our Chief Technology Officer ("CTO") is responsible for cybersecurity within our company, including information technology risks, controls, strategies and procedures. The Cybersecurity Subcommittee of the Board of Directors oversees cybersecurity for our company and meets with the CTO at least quarterly to discuss the status of cybersecurity efforts as well as any security incidents. Cybersecurity Subcommittee materials are provided to the Audit Committee as well as the full Board of Directors. The Board of Directors believes that a strong cyber strategy based on industry accepted best practices is vital to protect our business, customers and assets.

companyName: JOINT Corp

ticker: JYNT


text: A dedicated team of technology professionals works throughout the year to monitor all matters of risk relating to cybersecurity. We have begun our certification process for the globally recognized International Organization for Standardization certification for Information Security Management Systems (ISO 27001) that we expect to achieve by the second quarter of 2024. Additionally, we operate and are compliant under the following provisions: HIPAA attestation for the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification requirements.


text: Vendors that have access to our information are required to manage such information in accordance with laws and appropriate privacy and security standards. Standards are applied on a per-contract basis and include requirements to have an information security program and report to us any incidents in which its confidential information or systems are compromised. Depending on the nature of the vendors' access to our information, we monitor and evaluate the controls and governance established with the vendors ranging from a continuous cadence to at least quarterly.


text: We annually assess our cybersecurity programs against third-party requirements, including HIPAA and the Sarbanes-Oxley Act (SOX). We test multiple aspects of cybersecurity regularly, including annual pen testing over our proprietary information systems and have historically tested annually and beginning 2024 will test semi-annually our technical recovery and incident response procedures.


text: We maintain a robust privacy compliance program. Employees receive periodic email communications, which train them to detect and report malware, ransomware and other malicious software and social engineering attempts that may compromise our information technology systems. In the first quarter of 2024, we will be implementing a best in class security awareness training system and a quarterly training program for all employees.


text: Currently, we rely on an established major incident management and communication process to address any potential cybersecurity incidents. This established process includes the use of third party partnerships to make available the distinct skill sets needed to assist in properly responding to any cybersecurity threat. We are in process of establishing defined response procedures to effectively address any cyber threat that may occur regardless of the safeguards in place that minimize the chance of a successful cyberattack. The response procedures will be designed to identify, analyze, contain and remediate such cyber incidents expeditiously. These procedures and approach to safeguard our information and assets will be continuously monitored by management and updated to evolve with the current cyber landscape in alignment with the ISO 27001 standard mentioned above.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data"). Our information security function is led by our Director of Information Technology, with the support of our third-party specialists. Our information security function helps identify, assess and manage risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including automated tools, domain name system filtering, antivirus protection, vulnerability scanning and penetration testing.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Depending on the environment, systems and data, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include an incident response policy, encryption of certain data, network security controls, segregation of certain data and system monitoring. Our incident response policy provides the framework for the execution of cybersecurity incident response procedures and internal communications while adhering to applicable legal reporting and disclosure requirements.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Our information security function works with management to prioritize risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats. In addition, we use third-party service providers to perform a variety of functions throughout our business, including, for example, hosting and processing data, manufacturing our product candidates and assisting with R&D and clinical trial activities. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider, our vendor contracting processes may include imposing certain contractual provisions related to privacy and cybersecurity.


text: For a description about our cybersecurity risks, refer to Item 1A. "Risk Factors," to this Annual Report on Form 10-K "Significant disruptions of our information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us."


text: Our board of directors maintains oversight of our most significant risks and our processes to identify, manage and mitigate those risks. The audit committee of our board of directors (the "Audit Committee") has responsibility for oversight of our management of cybersecurity risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who reports to our Chief Operating Officer. Our Director of Information Technology is responsible for monitoring third-party specialists, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Operating Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Our Incident Response Policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Operating Officer. Our Chief Operating Officer and other senior management work with our incident response team to help mitigate and remediate cybersecurity incidents in which case they are notified. In addition, our Incident Response Policy includes reporting to the Audit Committee for certain cybersecurity incidents. The Incident Response Policy is managed and maintained by our Director of Information Technology, with oversight from our Chief Operating Officer. The Audit Committee receives periodic updates from our Chief Operating Officer regarding the status of our cybersecurity program and our posture to identify and mitigate risks to our information security.


text: At Vista Credit Strategic Lending Corp., we recognize the importance of assessing, identifying and managing risks associated with cybersecurity threats. These risks include operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws, and other litigation and legal, financial and reputational risks.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: We rely on the cybersecurity strategy and policies implemented by Vista, the parent of our Adviser. Vista maintains, and we rely on, a comprehensive cybersecurity program that is aligned to the National Institute of Standards and Technology's Cybersecurity Framework as part of its enterprise risk management program, including physical and digital technologies and administrative, operational, and technical controls, to aid in efforts to identify, assess and manage cybersecurity risks. The program is designed to provide for the availability of critical data and systems, maintain regulatory compliance, manage material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents. Among other things, the program includes a risk management framework; controls designed to monitor our digital infrastructure and detect and alert to suspicious, anomalous, and/or malicious behavior and indicators of potential cybersecurity threats; regular scanning of our networks and systems to triage and manage any potentially exploitable vulnerabilities; regular tabletop exercises to test our incident response and business continuity and disaster recovery preparedness; and annual Information Security Awareness training for employees.


text: Vista has an Incident Response Plan which guides the actions to be taken in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable compliance with applicable legal and regulatory obligations and mitigation of financial and reputational damage. The Incident Response Plan includes notification to the applicable members of cybersecurity leadership, including Vista's Chief Information Officer ("Vista CIO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on the nature of the incident, the incident may also be reported to Vista's Executive Committee, as well as to our Audit Committee and to our full Board, if appropriate. Vista also maintains a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents which may materially impact operations.


text: Vista engages with independent assessors and other third parties to validate security controls, standards, and policies, conduct annual penetration tests of networks and systems to identify threats and vulnerabilities, and assist with forensic analysis of material cybersecurity incidents. In addition, to identify and assess material risks from cybersecurity threats, Vista's enterprise risk professionals collaborate with subject matter specialists, the Vista CIO, and Vista's Chief Compliance Officer ("Vista CCO"), Vista's Chief Operating Officer and Vista's Chief Legal Officer, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: These processes are also designed to address cybersecurity threats associated with the use of third-party providers. When selecting third-party service providers, associated cybersecurity threats are assessed, and, in addition, ongoing cybersecurity risk assessments of third-party service providers are conducted. These third-party service providers are also required to provide notifications of material breaches that may impact Vista's data. Vista incorporates the cybersecurity risk coordination and assessment of third-party service providers into the overall cybersecurity program and enterprise-wide risk management.


text: We are not aware of any material cybersecurity incidents that have impacted us. However, Vista is aware that similar institutions, as well as its employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity threats in recent years and will likely continue to be the targets of increasingly sophisticated cyber-attacks. We described whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy and results of operations, under the heading "We are dependent on information systems and systems failures could significantly disrupt our business, which may, in turn, negatively affect our liquidity, financial condition or results of operations", included in Item 1A of this Form 10-K, which is incorporated by reference herein.


text: Cybersecurity is an important part of Vista's enterprise risk management processes and an area of focus for the Board of Directors and management for both Vista and us. These cybersecurity risk management and strategy processes are overseen by the Data Privacy and Information Risk Committee (the "DPIRC"). The DPIRC is co-chaired by the Vista CCO and Vista CIO, with members including senior representatives from Vista's Information Security, Legal, and Human Resources departments. The Vista CIO has extensive experience in cybersecurity and technology. The Vista CIO was appointed in 2017 and has over 20 years of cybersecurity, information security, and technology services and innovation experience.


text: The DPIRC is responsible for implementing, reviewing and revising cybersecurity policies and directives, as well as overseeing the protection, detection and response capabilities of cybersecurity resources. In addition, the DPIRC promotes, endorses and validates Vista's cybersecurity risk posture, reviews industry best-practices, provides strategic direction for cybersecurity matters and oversees cybersecurity training programs. The DPIRC is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, Vista's cybersecurity risk program and the operation of the Incident Response Plan and Business Continuity Plan and works in coordination with Vista's internal information technology departments to, among other things, implement, review and revise the policies underlying its cybersecurity program. Additionally, Vista's Enterprise Risk Committee receives quarterly information security updates from the Vista CIO.


text: The Board is responsible for the oversight of risks, including from cybersecurity threats. At least annually, the Vista CIO provides the Board with an overview of Vista's cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and the Incident Response Plan, as well as the steps taken to respond to such risks. Material cybersecurity threat risks are also considered during Board meeting discussions of matters such as enterprise risk management, operational budgeting, business continuity planning, brand management and other relevant matters.


text: The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, overseen by the Audit Committee and the Board of Directors. The Company has developed an information security program to address material risks from cybersecurity threats. The program includes processes identifying how security measures and controls are developed, implemented, and maintained.

companyName: WK Kellogg Co


text: Our cybersecurity processes align with the National Institute of Standards and Technology (NIST CSF) Framework. The company conducts regular risk assessments on systems and applications to detect potential risks, threats, and vulnerabilities. Additionally, annual assessments are conducted to evaluate the effectiveness of controls. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Several controls are employed to differing extents, encompassing but not restricted to endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring utilizing security information and event management (SIEM), multi-factor authentication (MFA), firewalls, intrusion detection, and prevention, as well as vulnerability and patch management.


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems. For example, third parties conduct assessments, such as vulnerability scans, penetration testing, and overall risk assessments, and third-party tools are utilized to identify potential vulnerabilities. The Company employs a variety of processes to address cybersecurity threats related to third-party technology and services, including privacy, solution and vendor risk assessments, imposition of contractual obligations, and performance monitoring. The Company also relies on services provided by Kellanova, a third-party entity, through a Transition Service Agreement (TSA). This agreement ensures the seamless continuation of essential operations during transitional phases.


text: To support our preparedness, the Company has a written incident response preparedness plan that we update as business needs and the security landscape change. In the event of a cybersecurity incident, our incident response team refers to the plan, and the Company conducts tabletop exercises to enhance incident response preparedness. The plan sets out clear response procedures, define roles, categorize incidents, determine materiality, record responses, comply with regulatory standards, assist in public disclosure, and lessen the impact on stakeholders. It is designed to enable a prompt, uniform, and efficient strategy to reduce the financial, operational, legal, and reputational risks associated with cybersecurity incidents. Business continuity and disaster recovery plans are used to prepare for the potential disruption of technology we rely on. The Company has implemented a user awareness program to enhance cybersecurity measures. These include phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon. For further discussion of these risks, see "Risk Factors—Risks Related to Our Intellectual Property and Technology—Technology failures, cyber-attacks, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business."


text: The Company has a Governance, Risk, and Compliance (GRC) IT function to address enterprise risks; cybersecurity is a category handled by that function. Cybersecurity is a vital pillar within a comprehensive risk management framework, fostering cross-functional collaboration to fortify organizational resilience against digital threats. The Company has a privacy and security governance committee. The company operates a privacy and security governance committee and a cybersecurity team led by a Chief Information Security Officer. With extensive cybersecurity experience across IT services, Telecom, and Manufacturing sectors, the Chief Information Security Officer spearheads cybersecurity risk and strategy and directly reports to the Chief Information Officer. Additionally, as part of our overall enterprise risk management strategy, our Audit Committee, which consists solely of independent directors, oversees cybersecurity and receives updates on cybersecurity matters, which include a review of potential digital threats and vulnerabilities, cybersecurity priorities, and our cybersecurity framework.


text: As of December 30, 2023, we are not aware of any material cybersecurity incidents that impacted the Company or are reasonably likely to impact the Company materially. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats rapidly evolve in sophistication and become more prevalent in the industry. We face risks of incidents, whether through cyberattacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, and other scams.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology (NIST) and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Owlet, Inc.

ticker: OWLT


text: Our cybersecurity risk management program is integrated into our Quality Management system, our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities; • cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer; • cybersecurity awareness training for employees; • security tools in our system to monitor and detect cybersecurity threats; • cyber liability insurance • a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and • a third-party risk management process, including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Technology Officer (CTO) and Chief Operating Officer are responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.


text: Risk Management Strategy We have implemented and maintain various information security processes. These processes are designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, strategic or competitive in nature, and proprietary or confidential information, including clinical trial data, personal and financial information, referred to collectively as Information Systems and Data.

companyName: NGM BIOPHARMACEUTICALS INC


text: Our Chief Financial Officer, or CFO, together with our Incident Disclosure Committee, or IDC, Security Incident Response Team, or SIRT, which is led by our head of information technology, or IT, and composed of two employees who have direct work experience in network security, and third-party service providers, help identify, assess and manage the Company's cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, automated and manual tools, third-party threat assessments and intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, evaluating the Company's and the industry's risk profile, evaluating reported threats, coordinating with law enforcement relating to threats, conducting threat assessments for internal and external threats, conducting red/blue team testing and tabletop incident response exercises jointly with external third parties.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident detection and response plan and policy; encryption of data; network security controls; access controls; physical security and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including for example threat intelligence service providers, penetration testing firms, dark web monitoring services, cybersecurity consultants and software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor which includes a security questionnaire, a review of the vendor's written security program, and security assessment calls with the vendor's security team.


text: Depending on the nature of the services provided the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "We, our CROs, our CMOs, our current and potential future partners and other third parties we rely on or partner with could experience a cybersecurity incident that could harm our business".


text: Our board of directors, or the Board, addresses the Company's cybersecurity risk management as part of its general oversight function. The Board has delegated to the audit committee of the Board, or Audit Committee, responsibility for overseeing the Company's cybersecurity risk management processes generally, including oversight and mitigation of risks from cybersecurity threats.


text: Our CFO is responsible for cybersecurity risk management and has experience overseeing IT departments in previous roles. Our principal accounting officer, or PAO, oversees the IT department and in that capacity is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our PAO has significant experience with managing access to key company-wide information systems. Our head of IT is responsible for assessing and managing our material risks from cybersecurity threats and for our cybersecurity protections generally, including helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Our head of IT has prior work experience in cybersecurity, holds relevant degrees and current cybersecurity certifications. The Audit Committee receives periodic reports from our CFO and head of IT concerning cybersecurity threats and risks, and the processes that we have implemented to address and mitigate them. The Audit Committee updates the Board on such cybersecurity issues as part of its general committee report to the Board at regular Board meetings. Our Board is responsible for approving budgets to support those activities.


text: We have in place a cybersecurity incident response plan, reviewed by the Audit Committee, which establishes incident response processes, policies and procedures. Under the plan, our CFO, as incident response leader, works with the Company's SIRT to help the Company mitigate and remediate cybersecurity incidents of which they are notified.


text: Our IDC is notified and activated in the event of a significant cybersecurity incident. The IDC is composed of our CFO, the lead of the SIRT, our General Counsel and other members of our legal and finance teams. In the event of a severe or major cybersecurity incident, the IDC will oversee and coordinate the response, determine materiality of impact and any disclosure requirements in conjunction with legal counsel and will ensure that the Audit Committee and/or the Board are updated and that required disclosures are made in a timely manner.


text: Bioventus maintains a cybersecurity risk management program that is designed to enable us to assess, identify, and manage risk associated with cybersecurity threats (the "Cybersecurity Program"). Our Cybersecurity Program is based on standards promulgated by the National Institute of Standards and Technology ("NIST") and the United States Cybersecurity and Infrastructure Security Agency ("CISA") and includes the following elements: • Identification and assessment of cybersecurity threats based on periodic internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources such as those made available by CISA. • Technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, technical controls, and employee education and awareness. • Processes designed to detect the occurrence of cybersecurity events and to respond to and recover from cybersecurity incidents. • A third-party risk management process designed to manage cybersecurity risks associated with our service providers, suppliers, and vendors.

companyName: Bioventus Inc.

ticker: BVS


text: Our Cybersecurity Program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit and Risk Committee of the Board of Directors. We also actively engage with key vendors, industry participants and threat intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of the Cybersecurity Program.


text: Integration of Risk Management Process Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Cybersecurity Program is integrated into our enterprise risk management program and framework. These programs are designed to foster a company-wide culture of appropriate cybersecurity risk management. Our IT Security team works closely with stakeholders across technology, legal, risk, and business operations to implement and monitor the effectiveness of the Cybersecurity Program.


text: Engagement of Third Parties in Connection with Risk Management The Company engages a range of external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These include cybersecurity consultants and external auditors to review the Company's cybersecurity posture and responsive efforts. Our relationships with these external partners enable us to leverage their expertise with the goal of maintaining best practices.


text: Oversight of Third-Party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact Bioventus in certain circumstances. We have implemented processes for overseeing and managing these risks. Those processes include assessing the third parties' information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements.


text: Risks from Cybersecurity Threats As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, a third-party vendor recently informed us that Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing certain of our claims for reimbursement related to our Exogen device to commercial payers experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems. As a result of the Change Healthcare incident, certain of our patient billing and collections processes have been disrupted. While we have identified an alternative claim processing intermediary and have resumed claims submissions to some payers, this event may cause delays in a portion of our claims submissions to some commercial payers thereby delaying the related cash remittances to us. As of the date of this Annual Report, UnitedHealth Group is still investigating this incident, including any potential impact on claims and patient data. On March 7, 2024, UnitedHealth Group issued a statement indicating that it expects to begin testing and reestablish connectivity to the effected claims network to restore service beginning March 18, 2024. We do not presently believe that the Change Healthcare incident has materially affected, or is reasonably likely to materially affect the Company, including with respect to our claims collection and cash flows. We continue to evaluate the impact of the Change Health incident on our Company.


text: The oversight of Bioventus' Cybersecurity Program falls under the purview of the Company's Director of IT Security, Risk and Compliance, who has over 25 years of combined technical and leadership experience, with the past 18 years focused on information security and technology risk management, and holds Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications.