text: The Company's President and Chief Information Officer, who has a Certified Chief Information Security Officer certification and over a decade of experience leading information and cyber security oversight, is responsible for developing and implementing our information security program, overseeing our IT team and reporting on cybersecurity matters to the Audit Committee. We view cybersecurity as a shared responsibility, and we consult with third-party resources and advisors as needed on information security maturity assessments, penetration testing, dark web reviews, best practices to address new challenges, and, when applicable, digital forensics. All employees are required to complete annual information security trainings and have access to more frequent online information security trainings.


text: We continue to prioritize our investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting capabilities and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. Further, we conduct periodic external penetration tests, bug bounty hackathons and maturity assessments to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, the Audit Committee and the IT security team also consider and evaluate cybersecurity risks associated with use of third-party service providers.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU

secItem: Item 1C


text: Our Board previously had a Technology and Innovation Committee which oversaw jointly, alongside the Audit Committee, matters of technology, innovation, cybersecurity and information security. The Technology and Innovation Committee was dissolved in September 2024 as part of the Company's Board restructuring and its responsibilities were redistributed to the Audit Committee. The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. The Audit Committee oversees cybersecurity disclosures and receives periodic reports from management and the IT team. Further, the Audit Committee periodically discusses the Company's actions to identify and detect threats, as well as its cybersecurity strategic roadmap.


text: In the fiscal year ended December 29, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Risks Related to Our Technology Infrastructure" in Item 1A-Risk Factors.


text: We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats. We also engage with third parties, including consultants, to enhance our security processes.

companyName: MUSTANG BIO, INC.

ticker: MBIO


text: We have previously engaged and currently engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.


text: We review the processes of our third-party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity."


text: While our board of directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our management team is informed of and monitors the prevention, detection, and mitigation of cybersecurity threats and incidents.


text: The Bank, as part of its risk management process, has implemented an information security program that encompasses the Bank's cybersecurity efforts. The Bank's goals of confidentiality, availability and integrity of its information are key to this process and program. The Bank's goals of protecting confidential information and safeguarding our digital assets are foundational objectives of the program.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors annually approve this information security program and regularly receive a report from the Bank's Information Security Officer that outlines the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer updates the Boards of Directors through supplementary reports on issues related to Cybersecurity readiness.


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer. Together with the Bank's Information Technology Committee, comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security Officer of the Bank works to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors receives training annually.


text: The Bank engages trusted third parties to audit and examine its processes, review the security of its network infrastructure, and assist the Bank in designing and implementing robust cybersecurity systems. These trusted third parties help the Bank improve and test its cybersecurity readiness. The Bank engages third-party vendors to monitor and test its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third-party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by specialized vendors that assist the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.


text: Although the Company and Bank have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected their business strategy, results of operations or financial condition, there can be no guarantee that the Company or Bank will not experience such an incident in the future.


text: As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation –Cybersecurity" included in Part I. Item 1 – Business of this report.


text: Cybersecurity risk is a significant operational risk facing our business. Cybersecurity risks result from intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our clients' or third parties' operations, systems or data. Cybersecurity risk management is an integral element of the Company's overall risk management strategy.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Management assesses and manages material risks from cybersecurity threats through designated management positions and committees that are responsible for overseeing technology and information security. Our Chief Technology and Information Security Officer ensures the coordinated and consistent implementation of risk management initiatives and strategies on a frequent basis with our Chief Operating Officer and Chief Financial Officer. Results of the information and cybersecurity efforts and recommendations are reported by the Chief Technology and Information Security Officer to the IT Steering Committee, Risk Management Committee and Board of Directors no less than quarterly. The Audit Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. Our management is directly involved in assessing and managing cybersecurity risks.


text: The Company uses the National Institute of Standards and Technology Cybersecurity framework ("NIST CF") for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We utilize Payment Card Industry Data Security Standards, and other applicable standards, laws, and regulations. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, and security event monitoring and security awareness. Certain processes involve the use of third parties.


text: Risk Assessment Process. On an annual basis, a risk assessment and maturity analysis is performed for the Company based on the NIST CSF Framework. The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events. The risk assessment considers the inherent risk and controls implemented at the Company and measures the residual risk to ensure it is within the Company's risk tolerance.


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the Company's information systems environment. Identified vulnerabilities are classified and scored based on severity, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.


text: Threat Management Process. In addition to the regular and routine vulnerability scanning, the Company relies on various threat intelligence feeds for the identification and awareness of potential threats that could impact the Company's environment. Using third party vendors to assist, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the Company environment. We continually enhance the cybersecurity capabilities based on evolving threats. We have adopted an incident response plan that applies in the event of a cybersecurity threat or incident.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests look at our customer facing applications, how we respond to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail utilizing best practices and the involvement of third party experts, as well as internal Information Security personnel and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.


text: Access Management. Utilizing a least privilege, need-to-know access methodology, access is controlled through a centralized user access management function responsible for the provisioning, transfer and de-provisioning of users' access. Access management also performs routine reviews of application and systems access to ensure access remains appropriate. For third-party hosted environments, access management works with security architecture to ensure single sign-on controls are employed or additional factors are utilized to prevent unauthorized access to these environments.


text: Network Security Management. The security of the Company's network infrastructure is maintained via the use of some network segmentation to isolate access to certain applications and systems, email filtering to identify spam, malware, and phishing messages in received email messages, data loss prevention controls to prevent the theft, or mass exfiltration of data, Virtual Private Networks to control remote access to our network, network access controls are in place to prevent unauthorized assets from connecting to the network, and web filtering.


text: Security Event Monitoring. The Chief Technology and Information Security Officer and Information Security personnel work together as centralized security monitoring team and are responsible for the response to alerts generated from a consolidated log collection system. Log collection occurs from various assets and hosted environments. The 24 x 7 monitoring is third-party provided security information and event management tool, and enables threat identification, detects suspicious activity in the environment using a nationally recognized, third-party framework, performs user behavior analytics, and endpoint detection and response. Alerts are investigated to ascertain whether a cyber-incident is occurring or not.


text: Security Awareness. Quarterly training is conducted for continuing education for all employees and monthly phishing tests are administered. We also email and post articles on our intranet of common attack schemes for our employees awareness. An annual cyber report is presented to the Board of Directors with monthly cyber reports.


text: Our Vendor Management Policy contains policies and procedures to follow when utilizing external third-parties and due diligence is performed over new vendors prior to engaging in services. Vendor Management ensures key risk components are mitigated based on acceptable Company standards. Any third parties used in any cybersecurity processes are vetted through our vendor management process.


text: Risks from Cybersecurity threats or previous incidents have not materially affected business strategy, results of operations, or financial condition. A vendor management report is presented to the Board of Directors on an annual basis by the Chief Technology and Information Security Officer.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BioXcel Therapeutics, Inc.

ticker: BTAI


text: We designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we used the National Institute of Standards and Technology Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a management team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Business interruptions could adversely affect future operations, revenues, and financial conditions, and may increase our costs and expenses."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the internal Security Incident Management Team or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Security Incident Management Team, which includes our Chief Financial Officer, the Executive Director of Information Technology, Chief Legal Officer and the Quality Assurance Director, has approximately 30 combined years of risk management experience and is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Security Incident Management Team's experience includes prior work experience in cybersecurity; financial management and controls, data quality assurance and liability and risk management.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks such as the National Institute of Standards and Technology ("NIST") and other similar industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NETLIST INC

ticker: NLST


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer and Senior Director of IT and Security.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we or third-party service providers undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats;


text: conduct regular cybersecurity awareness training for all employees; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Difficulties with our global information technology systems, including any unauthorized access or cyber-attacks, could harm our business" which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: Our sole director, who also serves as our President and Chief Executive Officer, regularly receives updates from other members of management regarding our cybersecurity threat risk management and strategy processes covering topics such as data security posture, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In these sessions, our sole director generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Financial Officer. Our sole director also receives prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer and Senior Director of IT and Security. Such individuals have over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to our sole director about cybersecurity threat risks, among other cybersecurity related matters, on a regular basis.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: MultiSensor AI Holdings, Inc.

ticker: MSAI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See " Risk Factors – We are subject to cybersecurity risks to operational systems, security systems, infrastructure, firmware in our thermal infrared technology and customer data processed by us or third-party vendors or suppliers and any material failure, weakness, interruption, cyber event, incident or breach of security could prevent us from effectively operating our business."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Technology Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the President and, as discussed below, periodically to our board of directors.

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our system or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence fees to facilitate and promote program effectiveness. Our Information Technology Officer and Information Security Officer, who report directly to our board of directors, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and reliance tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using third-party cybersecurity experts. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the board of directors. The Incident Response Plan is coordinated through the Information Technology Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company.


text: Our Information Technology Officer is accountable for managing our enterprise information security function and delivering our information security program. The responsibilities of this position include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors. The function, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals responsible, including third-party vendors, are generally subject to professional education and certification requirements.


text: Our board of directors has approved management committees including the Information Technology Committee, which focuses on technology impact, and its business impact. This committee provides oversight and governance of the technology program and the information security program. This committee is chaired by the Information Technology Officer and includes the Information Security Officer and the Chief Operations Officer. This committee generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Technology Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Technology Officer Information Security Officer provide quarterly reports to the board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the board of directors reviews our cybersecurity risk profile on a quarterly basis.


text: We have a multilayered framework for assessing, identifying, detecting and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology, or IT, systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would conduct an assessment of the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage third-party security services for audit, benchmarking, and improvement and use various tools and methodologies to manage cybersecurity risks that are tested regularly, including a cybersecurity assessment guided by the National Institute of Standards and Technology (NIST) cybersecurity framework and ongoing security awareness training. We oversee third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring. Vendors are assessed for risk based on the nature of their digital footprint, company profile, domain name services health, internet protocol reputation, external access threats and social engineering landscapes, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, and scans or other technical evaluations. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, simulated phishing tests, penetration tests, and threat intelligence feeds. The results of these assessments are reported to the Audit Committee of the Board of Directors.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: We have developed an incident response plan designed to coordinate the activities that we and our third-party service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.


text: Our business strategy, results of operations and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such cybersecurity risks or any future material incidents. For more information on our cybersecurity-related risks, see Item 1A, Risk Factors, elsewhere in this Annual Report on Form 10-K.


text: The Company's Senior Vice President, Controller and Principal Accounting Officer is responsible for managerial oversight of our cybersecurity program and reporting on cybersecurity matters to the Audit Committee of the Board of Directors and management. Our Senior Vice President, Controller and Principal Accounting Officer oversees the cybersecurity team, which include members of our internal IT department and is also supported by third-party service providers.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The Audit Committee of the Board of Directors oversees our cybersecurity risk and receives regular reports, with a minimum frequency of once per year, from our Senior Vice President, Controller and Principal Accounting Officer on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Promptly after becoming aware of a material cybersecurity incident affecting our IT systems or data, the Audit Committee would work with management to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity breaches.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes, which are effected principally through an outside information technology management/cybersecurity consultant and a computer security firm that we have engaged, include procedural and technical safeguards, response plans, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. Our computer security firm serves as our managed security services provider, and its services include managed detection and response, incident management, managed security awareness and a quarterly risk assessment. Our information technology management/cybersecurity consultant has responsibility for managing detection and incident response in consultation with out our managed security services provider. We considered the internal risk oversight programs of our information technology management/cybersecurity consultant and our managed security services provider before engaging them. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: KALA BIO, Inc.

ticker: KALA


text: While we have not experienced any material losses relating to cyber-attacks, in 2019 we were the subject of a successful phishing attempt. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors, or the Audit Committee, provides direct oversight over cybersecurity risk. Our Audit Committee and Board of Directors receive periodic updates from our Chief Business Officer, together with our outside information technology management/cybersecurity consultant, and the Audit Committee and Board of Directors is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Chief Business Officer is responsible for the management oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us to address cybersecurity risks. Our Chief Business Officer has many years of experience overseeing company-wide legal and compliance risks. Our Chief Business Officer is supported by our outside information technology management/cybersecurity consultant and our managed security services provider.


text: We have also established a cross-functional Cybersecurity Committee led by our Chief Business Officer serving as the chair and consisting of senior leaders within our organization. The Cybersecurity Committee, with assistance from our outside information technology management/cybersecurity consultant, oversees our cybersecurity policy, which includes risk assessment, investments in cybersecurity technologies, cybersecurity insurance and review of relevant information technology policies.


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with periodic cybersecurity training. This training program covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all cybersecurity incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: SmartKem, Inc.

ticker: SMTK


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.. Our third-party consultant team is managed by our Chief Financial Officer who reports to the Audit Committee at the board level, as appropriate.


text: As of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: We have established processes and policies for assessing, identifying and managing material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework and include a Cybersecurity Incident Response Plan ("CIRP"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: Our cybersecurity risk management processes, policies and CIRP are focused on (1) developing organizational understanding to manage cybersecurity risks, (2) applying safeguards to protect our systems, (3) detecting the occurrence of a cybersecurity incident, (4) responding to a cybersecurity incident and (5) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes. For instance, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection. We have engaged independent consultants and other third-parties to assist us in establishing and improving our policies. Our processes and policies include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats and, upon identification, we conduct additional due diligence as a part of establishing those relationships. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. For a description and additional information concerning material cybersecurity risks we face, see Item lA Risk Factors - Information Technology and Cybersecurity Failures or Data Security Breaches Could Harm Our Business.


text: Cybersecurity and risks related to our information technology and other computer resources are an important focus of our Board of Directors' risk oversight. The Board has created a Cybersecurity Sub Committee of our Audit Committee for oversight of cybersecurity and other information technology risks. Our Cybersecurity Sub Committee of our Audit Committee receives materials on a frequent basis to address the identification and status of information technology cybersecurity risks, and management, including our Chief Technology Officer (CTO), provides periodic updates to our Cybersecurity Sub Committee. The Sub Committee reports to the full Board regarding its activities. The full Board also receives briefings from management on our cyber risk management program.


text: The CTO is responsible for managing our information security team to ensure they are assessing and managing cybersecurity risks in accordance with our processes and procedures. Our CTO has over 25 years' experience managing enterprise information technology systems.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Pursuant to our CIRP, when a cybersecurity event has been identified through our detection processes, it is assessed in order to determine whether the event is a cybersecurity incident. Our CIRP designates the primary manager of a cybersecurity incident, describes the parties who should be informed about the incident and outlines the processes for containment, eradication, recovery and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, members of our senior management team and Board of Directors are notified of an incident and kept informed of the mitigation and remediation of the incident.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: The audit and risk committee of our Board (the "Audit Committee") oversees risks related to cybersecurity, including the security of corporate information and the steps management takes to monitor and control these risks. Management regularly briefs the audit committee on our cybersecurity risk profile, potential threats, and continuous improvement initiatives. Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, enhancing our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: We engage a third-party Managed Service Provider ("MSP") to implement technology infrastructure and oversee its tactical operations. Our MSP employs multiple people with experience in technical leadership, system architecture, network infrastructure and cybersecurity. We believe using an MSP provides economies of scale for a smaller-sized company such as ours, by allowing us access to a broad range of experience and tool sets that would otherwise be difficult to acquire in-house. Our MSP uses specialized third-party services and tool sets for identifying, protecting against, and detecting cyber incidents. Through these services and tools, our detection capabilities include, but are not limited to, near real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide near real-time alerts, log aggregation, and threat intelligence feeds.


text: In addition, we have engaged cybersecurity consultants, unaffiliated with our MSP, to advise management, assess our technology tools and review our cybersecurity practices. Our consultants utilized the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to assess our cybersecurity risk and governance practices. The NIST Cybersecurity Framework enables organizations, regardless of size, to apply principles and best practices of risk management to improve security and resilience.


text: Material Impact of Cybersecurity Threats While to date we are not aware of any material information security breaches and have not incurred significant operating expenses related to information security breaches, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the risks related to our business section for more information. Our incident response practices require incident assessments to be conducted in concert with our Chief Executive Officer, Chief Financial Officer and MSP. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats. We also engage with third parties, including consultants, to enhance our security processes.

companyName: Fortress Biotech, Inc.

ticker: FBIO


text: We have previously engaged and currently engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.


text: We review the processes of our third party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity".


text: While our board of directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats and our Chief Financial Officer leads these efforts on behalf of the management team. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our Chief Financial Officer is well-informed on emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents and is responsible for our internal cybersecurity programs and oversight of third-party cybersecurity vendors who monitor and execute on the prevention, detection, and mitigation of cybersecurity threats and incidents.


text: Orchestra BioMed, ("Orchestra" or "Company") maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, in conjunction with the Company's enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology environment including systems, hardware, software, data, people, and processes.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: The underlying processes and controls of cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Orchestra has an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: In addition, Orchestra maintains policies over areas such as information security, IT change and configuration management, acceptable use, access on/offboarding, and data backup and recovery to help govern the processes put in place by management designed to protect Orchestra's IT assets, data, and services from threats and vulnerabilities. Orchestra partners with industry recognized cybersecurity providers leveraging third-party technology and expertise. Cybersecurity partners to the Company, including consultants and other third-party service providers, are a key part of Orchestra's cybersecurity risk management strategy and infrastructure and provide services including maintenance of an IT assets inventory, periodic vulnerability testing, identity access management controls, including restricted access of privileged accounts, physical security measures at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and traffic monitoring and automated alerting, ongoing cybersecurity user awareness training, remote monitoring and management, capacity management, industry-standard encryption protocols, formalized processes over asset and data destruction, formalized change management processes, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, and assessment. In the event of an incident, the Cyber Risk Committee would be notified and appropriate action would be taken to resolve the incident, including notifying senior management and, as appropriate, the Board.


text: Orchestra has implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes assessment of vendors during the selection/onboarding process, internal controls and security standards of vendors, compliance with service level agreements, review of SOC 1 reports on an annual basis and a regular review of vendor contracts.


text: Orchestra's Cyber Risk Committee, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of Orchestra's cyber risk management program, and for informing senior management, the Board, and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes via selection of strategic third-party partners (such as the Company's virtual Chief Information Security Officer), and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Orchestra for strategic cyber risk management, advisory and decision making.


text: The Audit Committee of the Board of Directors oversees Orchestra's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Members of the Cyber Risk Committee brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of Orchestra's cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes reporting cybersecurity incidents and updates on Orchestra's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by Orchestra's Board of Directors, at least annually, as part of the Company's corporate risk oversight processes.


text: Orchestra faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Orchestra acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Orchestra's business, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the Company's service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See "Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations" in Item 1A (Risk Factors) for more information on cybersecurity risks.


text: Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to protect, detect, monitor, mitigate and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our audit committee or board of directors to discuss if deemed necessary or appropriate. We also alert employees to significant new cybersecurity issues on a regular basis.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: We rely heavily on third party service providers for our clinical development activities and cloud-based documentation and communications. A cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. We do not currently have a formal process in place for evaluating or reviewing third party vendor cybersecurity risks and procedures and rely on such third parties to implement adequate protectionary and detection measures.


text: We do not specifically utilize assessors, consultants, auditors, or other third parties to evaluate or enhance our cybersecurity programs. On an annual basis, our information technology risks, controls and procedures are reviewed by third-party experts as part of our Sarbanes-Oxley review and testing.


text: Board Governance and Management Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described in "Risk Management and Strategy," above.


text: Our board of directors has oversight responsibility for risk management, which it administers directly and with assistance from its committees, primarily the audit committee. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks, including cybersecurity.


text: The audit committee assists the board of directors by overseeing the steps management has taken to monitor and mitigate cybersecurity threats and risks. The audit committee receives reports annually from management on our cybersecurity strategy and program. Significant changes are reported to the audit committee from time to time. Cybersecurity incidents which are determined by management to be material will be reported immediately to the audit committee.


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for us to be adversely impacted. This impact could result in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. See "Part I —Item 1A. Risk Factors" for further discussion of these risks.


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion. Our internal auditors perform audit engagements to assess our strategies, policies, procedures, and controls to reduce the risk of a cybersecurity incident.

companyName: BATTALION OIL CORP

ticker: BATL


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. With the assistance and advice of our expert consultants, responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our Director of Information Technology, who reports to our Chief Executive Officer.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into our compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee of the Board having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cybersecurity, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.


text: In addition, the Audit Committee, with the assistance and advice of Company management and third-party consultants, oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The Audit Committee receives periodic reports from Company management regarding cybersecurity risk factors.


text: The Board routinely receives information and updates from Company management and the Audit Committee with respect to the effectiveness of the Company's information systems' security framework, which may include cybersecurity assessments, risk management, and mitigation measures. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts.


text: We have not identified an indication of a substantive cybersecurity incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A. Risk Factors above.


text: Securing Kroger's business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our businesses, meeting applicable regulatory requirements and maintaining the trust of our stakeholders. We have adopted enterprise cybersecurity risk mitigation and governance processes, which are set forth in the Kroger Cybersecurity Risk Management program ("CRM"), the Kroger Third-Party Cybersecurity Risk Management ("TPCRM") program and the Kroger Cyber Incident Response Plan ("IR Plan"). Our approach is guided by the principles of the CRM, which includes monitoring threats and vulnerabilities and assessing and monitoring related controls, supporting the Corporate Information Security function, the Chief Information Security Officer ("CISO") and Chief Digital Officer ("CDO"). Kroger's cybersecurity policies, standards, processes, and practices are integrated into our overarching risk management system in an effort to enhance our ability to safeguard our operations and information, which includes quarterly cybersecurity reporting to the Board, delivered by senior leadership.

companyName: KROGER CO

ticker: KR


text: Kroger Cyber Risk Management Program The CRM was developed in collaboration with third-party consultants and is aligned with the National Institute of Standards and Technology ("NIST"), Risk Management Framework ("RMF"), Cybersecurity Framework ("CSF") and the International Organization for Standardization 27001 ("ISO 27001"). The program includes security and privacy, risk-based controls, and incorporates lessons learned from cybersecurity incidents. Under Kroger's CRM, cyber risks, including cyber threats and cyber events/incidents, are assessed, treated, and monitored on a continuous basis. We integrate lessons learned from incident response and cyber risk mitigation into our cyber risk management strategy, in an effort to improve overall cybersecurity on an ongoing basis. Kroger's CRM program is spearheaded by specific management positions, chosen for their expertise in the field as further discussed below.


text: In line with cyber risk management best practices, we have collaborated with recognized third-party experts as needed to align the CRM's foundational processes, metrics, monitoring, and reporting with common frameworks such as the NIST RMF and the NIST CSF.


text: Third-Party Cyber Risk Management Recognizing the potential vulnerabilities posed by third-party relationships, Kroger has implemented a comprehensive TPCRM program. The TPCRM program is designed to assess third-party cybersecurity risks by employing third-party cyber risk assessments, vendor tiering, and a dedicated team tasked with recommending holistic improvements to strengthen Kroger's cybersecurity posture, sourcing, and contracting processes. Kroger's Information Security Operations Center ("iSOC") responds to known third-party incidents on a continuous basis. The iSOC is a part of the Corporate Information Security ("CIS") department and is responsible for detecting, responding to, and escalating security incidents. We partner directly with business stakeholders and technology custodians to determine an appropriate response to manage incident risk to minimize the effect to the business. This response process is a regular and critical function of the iSOC and is defined in a separate appendix to the IR Plan. Any material risk identified from these incidents is escalated and communicated using formal severity and impact criteria as defined in the IR Plan.


text: Kroger Cyber Incident Response Plan The IR Plan documents the processes by which information security events are detected, identified, prioritized, and analyzed. The Kroger iSOC, CISO, legal counsel, and corporate affairs stakeholders are then engaged depending on the incident's scope, business effect, and potential material risk. This cross-functional team is responsible for assessing an appropriate response and mitigation pathway. Once security events are identified through the enterprise detection and monitoring ecosystem, the IR Plan sets forth an incident prioritization/decision workflow to determine scope, business effect, and potential material risk. This workflow is implemented through collaboration with the iSOC, CISO, legal counsel, and corporate affairs stakeholders and correlates to industry standard severity levels. In addition to the processes outlined above, we have also implemented an information security training program for employees that includes security awareness training related to cyber security risks, simulated phishing emails and regular communication to the enterprise regarding cyber security risks.


text: We experience cybersecurity threats and incidents from time to time. We are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, our financial condition, results of operations or cash flows, and we have not experienced a cybersecurity threat or incident that has materially affected Kroger in at least the last three years. There can be no assurance that cybersecurity threats will not have a material effect on us, including our business strategy, our financial condition, results of operations or cash flows. Please see "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: Protection of our customers' data is a fundamental priority for our Board and management team. Our risk management team is integrated into our CIS function and is led by our CDO and CISO. The risk management team reports to the CISO and has combined experience in information security, governance, and compliance, including domains such as engineering, architecture, cybersecurity, and privacy. This team is responsible for defining the program, cybersecurity governance, and gathering insights related to assessing, identifying, and managing cybersecurity threat risks, their severity, and mitigations.


text: Kroger's CDO reports to the CEO and leads technology and digital capabilities for the Kroger Co., including the overall cybersecurity strategy. Kroger's CDO has over 20 years of both leading and transforming technology, digital growth, and e-commerce in the retail and food industry. He graduated with a master's degree in business administration and management from Ecole Sup rieure de Commerce de Chamb ry, Rh ne-Alpes, France. Kroger's interim CISO brings nearly 20 years of experience developing and leading security and risk programs. His experience includes governance, information security, and threat management. He graduated from Miami University with a bachelor's degree in management information systems and marketing.


text: The Audit Committee of Kroger's Board of Directors is charged with oversight of data privacy and cybersecurity risks. Kroger's CDO and CISO provide quarterly updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full Board at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the Board on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CDO and CISO discuss and present strategies to address geopolitical threats that may affect operations as well as technological changes, such as AI and quantum computing. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. An independent third party also regularly reports to the Audit Committee and the full Board on cybersecurity, and outside counsel advises the Board on best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: STARTENGINE CROWDFUNDING, INC.


text: Our Board has oversight of our strategic and business risk management and is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our Board also oversees risks related to privacy and data use, including overseeing compliance with our comprehensive privacy program. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.


text: Managing cybersecurity risks is an important component of our approach to enterprise risk management. As part of our overall risk management system, we have established certain procedures to assess, identify, mitigate and respond to risks from cybersecurity threats. We have regular programs to evaluate cybersecurity threats and to assess our systems, procedures and processes in order to identify areas of potential vulnerability and to improve our protection against evolving cybersecurity threats. We use the Center for Internet Security's Critical Security Controls framework in our regular assessment of cybersecurity risks with respect to our information systems, including vulnerability management, access controls, infrastructure hardening, employee training and evaluation of external threats, including in connection with potential data breaches, ransomware and other forms of unauthorized access.

companyName: RH

ticker: RH


text: As part of our overall cybersecurity protection program, we have created a cross-functional cybersecurity team consisting of senior members of information technology, legal, accounting, internal audit and compliance teams (the "Incident Response Team") that contributes to various aspects of our approach to managing cybersecurity risks. Our senior information technology leaders who are members of the Incident Response Team have experience and domain expertise in cybersecurity, including defining and implementing security policies and tools, understanding and evaluating relevant threats to our technology infrastructure as well as developing incident response protocols and security operations workflows. We also incorporate third-party expertise in various aspects of our cybersecurity program, including in the assessment and testing of weaknesses as well as the adoption of software and other solutions to mitigate risks and identify and respond to threats. Our Incident Response Team is involved in all aspects of our program to address cybersecurity matters, including with respect to the design and management of internal controls and procedures governing these matters.


text: Our information technology team oversees the day-to-day management of our cybersecurity program with regular reporting to representatives of our Incident Response Team. Our information technology team has overall responsibility for our cybersecurity risk management program and procedures and reports regularly to the Audit Committee of our Board of Directors on cybersecurity matters. From a governance perspective, (i) we have an executive response team consisting of various senior executives, including our Chief Financial Officer, as well as members of our Incident Response Team (the "Executive Response Team") that oversees the recommendations, actions and responses of the Incident Response Team in connection with specific cybersecurity incidents, and (ii) the Audit Committee as well as our Chief Executive Officer are provided with updates from the Executive Response Team and the Incident Response Team regarding incidents as well as the policies, standards, processes and practices that we implement to address risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity matters that address a wide range of topics, including recent developments, evolving standards, vulnerability assessments and third-party reviews.


text: We have a written information security incident response plan (the "Incident Response Plan") that we use to assist in our response to cybersecurity incidents. The Incident Response Plan provides a framework and process for our Incident Response Team. While our Incident Response Team identifies our initial response to potential or actual cybersecurity incidents, the Executive Response Team oversees the actions and recommendations of the Incident Response Team in connection with specific cybersecurity events. In addition, we have various processes to escalate matters based upon the threat level severity. The Incident Response Team and Executive Response Team (i) make ongoing assessments of the severity of incidents, (ii) escalate these matters based upon the severity of the threat level, (iii) depending on the level of severity of an incident, also involve our Chief Executive Officer or Audit Committee and Board of Directors in assessing specific cybersecurity incidents, (iv) determine the appropriate level of response to specific incidents taking into account the nature of the incident, and (v) take overall responsibility for leading and coordinating response efforts, involving additional response team participants and retaining third-party assistance, including legal counsel and other third-party cybersecurity experts, and assessing materiality of an incident.


text: Threat Mitigation While we engage in numerous efforts to protect ourselves from cybersecurity risks, we do periodically experience cybersecurity incidents. To date we have not experienced any cybersecurity threat or incident that has materially affected our business, results of operations or financial condition. We have also not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Although we have adopted various processes and preventative measures with the objective of preventing breaches and minimizing the risks from cybersecurity matters, given the nature of cybersecurity threats that are constantly evolving over time, there is no guarantee that we, including our business strategy, results of operations or financial condition, will not be adversely affected by such threats or that our preventative measures and processes will be effective. Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events.


text: For further discussion of our risks related to cybersecurity, refer to Item 1A—Risk Factors—Material damage to, or interruptions in, information systems as a result of external factors, staffing shortages, cybersecurity breaches or cyber fraud, or difficulties in updating our existing software or developing or implementing new software could have a material adverse effect on our business or results of operations, and we may be exposed to risks and costs associated with protecting the integrity and security of our customers' information.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: Primary responsibility for executing our cybersecurity program rests with our Vice President of Corporate Strategy and Planning, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of related work experience. The Vice President of Corporate Strategy and Planning is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Executive Officer. The Vice President of Corporate Strategy and Planning at times attends meetings of the Board to report on any material developments to our risk management practices, including our cybersecurity program.


text: The Vice President of Corporate Strategy and Planning meets regularly with members of our Information Technology team, whose responsibilities are dedicated solely to cybersecurity matters. On a quarterly basis, we hold Information Technology Steering Committee meetings, which are attended by our Information Technology team, Chief Executive Officer and Chief Financial Officer, where we discuss the risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Our Information Technology team also works with our Vice President – General Counsel to oversee compliance with legal, regulatory and contractual cybersecurity requirements.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our Information Technology team. We regularly conduct vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.


text: Our Board has the primary responsibility to oversee cybersecurity matters. The Board periodically reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board receives reports from the members of our management team responsible for executing our cybersecurity program, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board discusses with such members of our management team our information technology systems and procedures on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board in a timely manner.


text: We have adopted an Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third-party vendor on retainer to assist in such incidents.


text: We rely on third-party information technology vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our own and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions or statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us nor are they reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: We recognize the critical importance of maintaining the trust and confidence of business partners, employees and patients, toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the UK governments' National Cyber Security Centre and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS