text: Our management team, including our Head of Information Technology and Chief Legal Officer and Head of Operations, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 30 years of leading and managing IT infrastructure and security operations teams for various sized global companies across several different industries.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Unity Biotechnology, Inc.

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy Identifying, assessing, and managing material risks associated with "cybersecurity threats," as such term is defined in Item 106(a) of Regulation S-K, is important to Bitcoin Depot. Among the risks we strive to address and mitigate are the disruption of our business operations and the loss of personal and confidential data due to cybersecurity incidents, fraud, or extortion.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: We integrate the identification, assessment, and management of cybersecurity risks into our overall risk management systems and processes. We detect and address such risks from cybersecurity threats in several ways, including through third-party assessments, internal governance, risk and compliance, participation in industry groups to obtain intel, IT audits, and IT security reviews. To protect against, detect, and respond to cybersecurity incidents, we, among other things, leverage intrusion prevention and detection systems, perform penetration testing, conduct employee training, monitor emerging laws and regulations related to data protection and information security, and implement appropriate changes to comply with the identified emerging laws and regulations. To effectuate these processes, we regularly engage third-party auditors and advisors to assess our cybersecurity programs and ensure compliance with applicable guidelines, standards, and industry best practices.


text: Senior management, including our Bitcoin Depot's Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel are responsible for implementing these security measures, as well as being involved in all aspects of cybersecurity incident response and data breach management processes. Bitcoin Depot's incident management plan provides a roadmap for responding to and categorizing incidents. Bitcoin Depot's IT and cybersecurity teams collaborate with other company stakeholders to develop strategies for mitigating and responding to identified cybersecurity events.


text: Our cybersecurity threat and risk management processes also involve assessing third-party risks. We maintain a Vendor Management Policy pursuant to which we assign a risk rating and assess third-party risks by conducting cybersecurity due diligence on our vendors, suppliers, and other entities with whom we do business. Due diligence includes, as appropriate, either requiring proof of security standard compliance or satisfactory responses to our Vendor Assessment Security Questionnaire. We also evaluate the cyber practices of, and cybersecurity risks associated with, the engagement of third-party service providers, including when we negotiate cybersecurity and data privacy contract terms, such as those relating to information security and audit rights.


text: Although we constantly evaluate cyber risks, we are unaware of any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial conditions.


text: Our Board of Directors and management prioritize cybersecurity. Although our full Board of Directors is generally responsible for cybersecurity risk management, it has assigned principal oversight responsibility of risks from cybersecurity threats to our Audit Committee. As described above, management is also responsible for assessing and managing risks from cybersecurity threats, and designated management personnel, including our Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel and Corporate Secretary meet quarterly as a Risk Committee to determine cybersecurity matters to be shared with the Audit Committee. The Risk Committee provides the Audit Committee updates on such matters on at least a quarterly basis. The Audit Committee reports cybersecurity risks to the full Board during quarterly meetings.


text: The members of senior management involved in managing our material risks from cybersecurity threats, including our Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel and Corporate Secretary are experienced in data security matters and financial reporting matters. Our Chief Information Security Officer has more than 20 years of experience in information technology and has served in multiple technology executive roles, including security-compliance-related roles and holds a degree in Computer Information Systems from Harding University. Our Chief Technology Officer holds a computer science degree and Master of Engineering in Computer Science from Massachusetts Institute of Technology and has held engineering roles in multiple financial technology companies. Our Cybersecurity Operations Director holds a Master of Science degree in computer engineering as well as a Master of Science degree in information assurance, both from Iowa State University. He has led the security operations centers for large, global data management software company, as well as a large payment processing company. Additionally, he has led audits and penetration tests as the senior manager of a consulting company. Prior to entering into the private sector, he served as a police officer where he was a detective, specializing in computer crimes and forensics. Our Chief Financial Officer has over 30 years of experience in financial statement reporting and auditing. Our General Counsel has significant experience advising on cybersecurity matters and data protection matters and building out cybersecurity and data privacy compliance program across business lines in the financial services industry.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our management actively oversees our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. We have established and maintain a Cybersecurity Maturity Model Certification ("CMMC") compliance program and are working to meet all applicable deadlines. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's investment in people and technologies have contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: GRESHAM WORLDWIDE, INC.


text: At a high level, the key objectives for the Company's cybersecurity program are to implement and sustain effective security controls to stop intrusion attempts and to maintain and continuously improve its ability to respond to attacks and incidents. Success in achieving these objectives relies upon using quality technology solutions, cultivating and maintaining a team of skilled professionals, and improving processes continuously. Our cybersecurity program in particular focuses on the following key areas:


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment are used to develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment that are then reported to our members of management.


text: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: We have established comprehensive incident response and recovery plans that guide our response in the event of a cybersecurity incident. We continuously test and evaluate the effectiveness of those plans.


text: We have implemented a vendor risk management program, which is designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of on-boarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers in response to detailed questionnaires and meetings as well as information from third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate. Contract language, purchasing decisions, and/or technology implementation strategies are frequently adjusted as a result of this process.


text: Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. As part of that educational process, we periodically simulate cybersecurity threats to the Company and review/assess employee responses. In this regard, the Company has implemented policies and procedures for all employees including: (i) information security/cybersecurity policies, which are internally available for all employees, (ii) information security/cybersecurity awareness training; (iii) a clear escalation process which employees can follow in the event an employee notices something suspicious; and (iv) ensuring that information security/cybersecurity is part of the employee performance evaluation and/or disciplinary process.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels, and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Nuburu, Inc.

ticker: BURU


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents. We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations, and cash flows, under the heading "Cyber-attacks and other disruptions, security breaches, and incidents could have an adverse effect on our business, harm our reputation, and expose us to liability" included as part of our Item 1A. "Risk Factors" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: The Company outsources around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures, and cybersecurity risks. Periodically each year, the Audit Committee receives an overview from our Chief Executive Officer of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified, and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: We are a clinical stage biopharmaceutical company, with no commercial operations or revenue streams and our sole business activity has been ongoing research into our drug therapies. We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our company grows, we plan to expand our strategy for cybersecurity in alignment with nationally accepted standards. We have not encountered cybersecurity risks that have materially affected or are reasonably likely to materially affect us or our business strategy. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. Our Audit Committee, comprised of members with substantial experience in information technology governance and risk management, oversees our cybersecurity strategy. They are advised by a virtual CISO consultant with Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP certifications, as well as extensive background in IT infrastructure, risk mitigation, and incident response planning. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: The Company has adopted processes designed to assess, identify, and manage material risks from cybersecurity threats that are integrated into the Company's overall risk management system. The Company's cybersecurity risk management processes are managed by Tuearis Cyber ("Tuearis") an outside contractor with significant experience and expertise in designing and implementing cybersecurity programs for corporate entities such as the Company.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: During the year ended December 31, 2023, the Company did not experience any risks from cybersecurity threats that materially affected or were reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: The Company's Board of Directors, through its Audit Committee (the "Committee"), working closely with the Company's corporate governance consultant, provides oversight of risks from cybersecurity threats by monitoring incident-based reports from Tuearis as to the existence and severity of such risks. When risks are identified, the Committee works with the Company's corporate governance consultant to develop appropriate responses, based on the recommendations of Tuearis. The Company does not have an employee with specific expertise in cybersecurity risk management but relies on Tuearis to provide that expertise. All material cybersecurity risks, incidents, and responses are reported to the Committee as a routine matter.


text: As a vertically integrated self-hosted and self-mining Bitcoin miner, the stability and security of GRIID's operating environment, the protection of our intellectual property, and the integrity and cybersecurity practices of strategic third parties are critical. GRIID's information security program is designed to detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our systems from cybersecurity threats, we use various security tools that help prevent, escalate, investigate, and recover from identified vulnerabilities and security incidents in a timely manner. We also maintain a third-party risk management program to identify, prioritize, assess, mitigate, and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk and cannot guarantee their efforts will be successful in all circumstances.

companyName: GRIID Infrastructure Inc.


text: We regularly assess risks from cybersecurity and technology threats and monitor our systems for potential vulnerabilities and exploit attempts. We use a widely adopted risk quantification model to identify, measure, and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We take a risk-based approach to regular reviews and tests of our information security program and also leverage tabletop and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties and employees) and other data, confidential information, or intellectual property. To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report.


text: The Vice President of Information Security leads our information security program. Our VP of Information Security has over 20 years of industry experience, including serving in similar roles leading and evolving cybersecurity programs at other public companies. Regular reports are provided to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: As a newly public company, GRIID's Board of Directors will oversee our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. This oversight will include regular discussions on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: We deploy several processes for assessing, identifying and managing material risks from cybersecurity threats. These processes include, but are not limited to, security assessments, physical access restrictions, internal and external penetration testing, endpoint detection and response, and employee security awareness programs and training.

companyName: Fathom Digital Manufacturing Corp


text: Our cybersecurity processes have been integrated into our overall risk management processes, and we engage assistance from third parties as we deem necessary or appropriate. We believe that we have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third-party services providers to our business.


text: Our Information Technology team, under the direction of the Chief Executive Officer, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. They have many years of experience in various technology-related functions including security, auditing, compliance and systems. Our executive officers are briefed regularly on information security, including discussion of processes such as those listed above to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Our Board is charged with providing oversight of our risk management process, including risks from cybersecurity threats. Periodically, the Board reviews risk assessments, including cybersecurity risks, prepared by management and/or third-party providers.


text: There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including, but not limited to, exploitation of vulnerabilities, ransomware, denial of service, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.


text: We have an information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards.

companyName: SeaStar Medical Holding Corp

ticker: ICU


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.


text: We are committed to safeguarding our information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction. We aim to incorporate industry best practices throughout our cybersecurity program. This program is supported by both management and our Board of Directors, including our Audit Committee.

companyName: Astra Space, Inc.


text: The Compliance Committee is responsible for identifying, monitoring and mitigating compliance risks, including cybersecurity, and is comprised of the Chief Compliance Officer & General Counsel, CEO, CFO, Chief Technology Officer, Chief Business Officer, Chief People Officer, Vice President of Information Technology ("VP IT"), Corporate Controller and Senior Director, Internal Audit. The Compliance Committee meets regularly during the year and receives periodic updates on cybersecurity risks from the VP IT. The Compliance Committee is responsible for assessing the materiality of cybersecurity incidents based on quantitative and qualitative materiality factors, and for providing recommendations on public disclosures of cybersecurity incidents to the Audit Committee if an incident is identified to be possibly material. The Compliance Committee also provides input and consideration into internal controls surrounding cybersecurity along with reviewing cybersecurity risks, mitigation strategies, ensuring the cybersecurity strategy is in alignment with business objectives and is incorporated into the overall risk management processes.


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The Department of Defense's Cybersecurity Maturity Model Certification ("CMMC") initiative safeguards sensitive information within the Defense Industrial Base by ensuring members meet cybersecurity requirements for handling controlled unclassified information and federal contract information. The CMMC initiative helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe.


text: In addition, we have technology and information security processes, security and threat assessment plans and safeguards and periodic external service and service provider reviews in place led by our VP IT, governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the Board of Directors (including the Audit Committee chair).


text: Our Board of Directors has overall responsibility for risk oversight and is currently overseeing Astra's business continuity risks, including cybersecurity risks, which occurs at both the full Board level and at the Board committee level through the Audit Committee. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity from the VP IT, at least four times a year including, but not limited to, analysis of events that have impacted our peers, updates on program maturity, regulatory compliance status and cybersecurity program status and updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents impacting the Company, as well as any incidents with lesser impact potential. The Audit Committee regularly briefs our Board of Directors on the matters communicated to the Audit Committee.


text: Our VP IT leads our information technology and cybersecurity function, including the role of Chief Information Security Officer ("CISO"), since early 2022. Our VP IT holds a Bachelor of Science in Cybersecurity and Information Assurance and is a systems security certified practitioner ("SSCP"). Our VP IT has served in various roles in information technology for over 25 years, including as vice president of a major cybersecurity company, where he directly oversaw the technical operations and cybersecurity. The VP IT oversees information security resources designed to assess and manage cybersecurity threats on a day-to-day basis.


text: Notwithstanding the foregoing efforts, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. No security program can entirely eliminate the risk of human error or malicious acts that are outside our reasonable control. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See Item 1A. Risk Factors for additional details regarding cybersecurity risks.


text: We believe we have appropriate processes for assessing, identifying and managing material risks from cybersecurity threats. Those processes are embodied in our enterprise-wide cybersecurity risk management program (Cyber Risk Program), which includes our cybersecurity governance structure and our cybersecurity strategy and processes.

companyName: E2open Parent Holdings, Inc.


text: Our board of directors has delegated oversight of our Cyber Risk Program to the Risk Committee of the board of directors. The presentations to the Risk Committee cover, among other things, our cyber incident experience, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages and our employee-training programs.


text: Management's Assessment and Management of Cybersecurity Threats Members of the executive management team, along with others from senior management and others with varying areas of expertise, are engaged as part of our Cyber Risk Program: • Executive Vice President, Product Development & Infrastructure R&D: Direct management of our Cyber Risk Program falls within our Product Development and Infrastructure Research and Development team. The Executive Vice President (EVP) in charge of this team has extensive experience regarding cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as E2open. The EVP is a member of our Cybersecurity Subcommittee of our Disclosure Committee, which is responsible for helping to determine whether a Cybersecurity Incident is "material" for purposes of publicly reporting cybersecurity incidents. Our EVP chairs our management Cybersecurity Subcommittee. • General Counsel: Our General Counsel has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims and loss mitigation. Our General Counsel is a member of our Cybersecurity Subcommittee of our Disclosure Committee. • Senior Vice President, Information Security and Compliance: Our Senior Vice President (SVP) has direct management of our Cyber Risk Program. He manages the day-to-day operations, oversees our security analysts and engineers and participates in our Cybersecurity Subcommittee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Subcommittee: We have created a Cybersecurity Subcommittee of our management Disclosure Committee which includes, in addition to the EVP and General Counsel, the Chief Accounting Officer. The Cybersecurity Subcommittee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts and make recommendations to leadership. Additionally, the Chair of the Subcommittee shall convene a meeting when either: (a) he believes a reported incident or the occurrence of a series of related incidents, requires the analysis and discussion of the Subcommittee; or (b) when any member of the Subcommittee believes that such a discussion would be appropriate. Such meeting shall be convened within 48 hours of the incident, or sooner if reasonably practicable, to expedite a materiality determination for public company reporting purposes.


text: • Response Team: Pursuant to our Crisis Response Program, our Response Team, which comprises the General Counsel, Chief Financial Officer and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the General Counsel or Chief Financial Officer, on behalf of the Response Team, will report to or engage the Chief Executive Officer and the Chairman of the board of directors if and when an incident becomes a crisis or potential crisis. • Other Roles: The Cyber Risk Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines and independent auditors to certify compliance with our internal control over financial reporting, the American Institute of Certified Public Accountants' Systems and Organization Controls (SOC 2) security framework. We also conduct reviews for compliance with data protection regulation such as Europe's General Data Protection Regulation (GDPR) and regulation of various U.S. states such as the California Consumer Privacy Act (CCPA).


text: Overview of Processes for Assessing, Identifying, and Managing Material Cyber Risks The principal objectives of our Cyber Risk Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property and other assets of E2open, and those of our customers, vendors, partners, employees and consumers that can be at risk due to cybersecurity threats to E2open.


text: We have incorporated industry recognized cybersecurity frameworks and standards into our Cyber Risk Program, including frameworks from the National Institute of Standards and Technology (NIST) and security control auditing protocols from the Center for Internet Security (CIS) and the International Organizations for Standardization (ISO). Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, we continue to invest in updating and enhancing our Cyber Risk Program.


text: Under our Cyber Risk Program, our SVP, and the cybersecurity staff, along with our management-led Cybersecurity Subcommittee, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in our various policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Risk Committee and board or directors, informed. Pertinent policy and practice documents include, among others, E2open's Guidelines for Cybersecurity Determination for Item 1.05 of Form 8-K (governing the Company's materiality determination for reporting purposes) and our Crisis Response Plan.


text: As an important cybersecurity risk mitigant, E2open provides mandatory training to its new hires and quarterly training of its employees, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.


text: Integration into Overall Risk Management System or Processes Our risk management systems and processes comprise numerous components, including published policies and procedures, risk detection systems, tools, and protocols (automated and human), internal and external independent auditing, management committee review, defined lines of communications, employee training, engagement of outside advisors and experts, assessment and utilization of both commercial and self-insurance opportunities, customer contract standardization where possible, legal review of vendor engagements and new products for regulatory compliance, regular operations reviews with the Chief Executive Officer and Risk Committee. E2open utilizes the foregoing systems and processes to best ensure effective management of our risks and associated cybersecurity threats. The EVP reports to the Risk Committee at least quarterly on the status of our Cyber Risk Program.


text: Engagement of Third Parties As part of our Cyber Risk Program, we engage outside independent auditors, consultants, and professional advisors. We also engage industry-leading cybersecurity service and systems providers to assist with protection from and detection of cybersecurity threats and incidents and our responses to them.


text: Risks from Third Party Service Providers and Others Our cybersecurity team, under the oversight of the SVP, performs risk assessments on third party service providers and other third parties (such as partner companies), as well as third party software and hardware utilized in its operations, that may have the potential to create cybersecurity threats to our data and operations.


text: Risks from Cybersecurity Threats—Likely Material Impact See the risk factor entitled Cyber-attacks and security vulnerabilities could result in serious harm to our reputation, business and financial condition. in Item 1A, Risk Factors. We do not believe any risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect E2open.


text: The Company is committed to, and recognizes the importance of, information security, cyber readiness, and data privacy protections to our business and reputation, which includes assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity program uses processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks.

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: The Company employs a number of tools and services, such as network monitoring and vulnerability assessments to inform our risk identification and assessment processes. We also maintain an incident response plan that outlines processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate cybersecurity incidents while also complying with relevant legal obligations. Our employees receive cybersecurity awareness and sensitive information protection training on a regular basis, which we also periodically test for effectiveness through simulations, which may include simulated phishing emails and tabletop exercises. Additionally, the Company regularly makes assessments related to the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems the Company uses. We also maintain cybersecurity risk insurance.


text: Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management function, which includes members of our executive leadership team, serves as a second line of defense, bringing holistic risk oversight while serving as a partner to the business to help strategically manage risk. In particular, cybersecurity risks are monitored by a team composed of members of our executive team, who in turn provides updates to the Audit Committee of our Board of Directors, who is responsible for assisting the Board of Directors with oversight over cybersecurity risks.


text: Through the processes described above, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. See Part I, Item IA. Risk Factors – "Risks Related to Our Information Technology and Security".


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our information security program, including the Company's technology and information security policies and practices, the internal controls relating to information security, and the steps taken by management to identify, monitor, and control any risk exposures. Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and employee training. Role or project specific employee training, as well as other training, may also occur, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer ("CIO"), who is assisted by other members of our senior management team. The team engaged in the cybersecurity risk management process, including the CIO, has risk management backgrounds, certifications, and/or cyber experience in prior professional roles and at the Company. The team also maintains expertise on cyber risk management through third party consultants, external training, and affiliations with relevant organizations.


text: Given the importance of information security to our customers, employees, suppliers and other partners, our Board and/or the Audit Committee receives reports as needed from our CIO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks.


text: We believe that cybersecurity is important to maintaining the trust of our customers and employees. We have implemented a cybersecurity risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats which could adversely affect the confidentiality of our data and the integrity of our business operations and financial systems. Our cybersecurity program is based on best practices and guidelines of the National Institute of Standards and Technology Cybersecurity Framework. We have company-wide policies and procedures in place that further enhance our ability to identify and manage cybersecurity risk.

companyName: ENNIS, INC.

ticker: EBF


text: Annual risk assessments and penetration testing are performed by independent third party consultants. These tests are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. The results of these tests are presented annually to the Board of Directors ("Board"), Audit Committee, and senior management for review to ensure compliance with cybersecurity standards.


text: During the fiscal year ended February 29, 2024, we have not identified any risks from cybersecurity threats that have materially affected our business operations or financial conditions.


text: Our Board of Directors, Audit Committee and senior management oversee risk management to ensure that the Company's policies and procedures are functioning as intended to protect the Company's information systems from cybersecurity threats. The Audit Committee performs an annual review and discussion of the Company's cybersecurity program, which includes planned actions in the event of a threat or recovery situation.


text: Our IT team is led by the Vice President of Administration and the Director of Information Technology. The latter is responsible for regular assessment and management of cybersecurity risks. The Director of Information Technology has constant access to the Audit Committee to provide regular updates as necessary regarding any new developments.


text: We view cybersecurity as a shared responsibility of the Audit Committee and the IT team led by the Director of Information Technology, and we incorporate external resources and advisors as needed to conduct evaluations of our security controls through penetration testing, independent audits and consulting on best practices. The results of those tests are presented annually to the Board.


text: We have taken steps to develop and implement a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Evoke Pharma Inc

ticker: EVOK


text: Our cybersecurity risk management program includes: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; and • cybersecurity awareness training of our employees and senior management.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to our Business, including the Regulatory Compliance and Commercialization of our Product, Gimoti— Our business and operations would suffer in the event of information technology system failures, cyberattacks, and other security incidents."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee ("the Audit Committee"). The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program, as required. Board members may receive presentations on cybersecurity topics from external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our President and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our management team's experience includes decades of experience in overseeing operations, including information technology functions, in the public company environment.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.


text: Managing cybersecurity risks and securing our sensitive data and systems are a critical part of our business operations and of paramount importance to our organization. The Company has implemented and maintains multiple layers of physical, administrative, and technical security processes designed to protect our facilities from disruptions that may result from cybersecurity incidents, as well as safeguard the confidentiality of our critical systems and data residing on those systems, including employee data, customer data, and proprietary information.

companyName: VOXX International Corp


text: Our approach consists of best practice standards, policies, and processes for identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats. Our cybersecurity goals are to leverage industry-wide recognized standards, such as The National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: We have implemented best practices and established numerous controls to reduce cybersecurity risk. Some key components include: • Leveraging third-party cybersecurity vendors to test our systems, identify previously undiscovered risks in the environment and validate existing cybersecurity controls. We maintain a process to oversee and identify risks from cybersecurity threats associated with our use of third-party vendors with access to our resources. • Educating our users on cybersecurity prevention tactics through security awareness training and ongoing phishing testing. • Protecting Email through multiple layers of security that cover all internal and external communication. • Utilizing a patching and remediation process for our systems. We use a managed risk service to help detect and prioritize vulnerabilities found in the environment and track them for remediation. • Having a data recovery plan and controls designed to protect against business interruption, including multiple backups of our critical systems. • Deploying technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, access controls, extended detection and response, and event monitoring. • The company maintains a Cybersecurity Insurance Policy.


text: On an ongoing basis we conduct cybersecurity risk assessments, including compiling, reviewing, and acting on information garnered from internal stakeholders, known security vulnerabilities, and data from external sources. The results of these assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.


text: We routinely assess our systems and processes for modifications in advance of evolving state privacy regulations and other applicable industry standards and regularly update our privacy and information security policies to remain current with industry practices. We are continually adapting to the ever-changing cyber risk landscape and have a team of information security professionals committed to maintaining the highest levels of systems and data security. The Company itself conducts, and has engaged external information security firms to conduct, assessments, including penetration tests, to continually improve security controls and ensure security controls. We continue to expand and grow our security team and their skillsets and make regular enhancements to our cybersecurity risk management goals.


text: In addition, we engage with our third-party business partners to enforce our internal cybersecurity practices. We rely on all third-party business partners to maintain appropriate security programs; however, we cannot ensure in all circumstances that their efforts will be successful. We assess third-party cybersecurity controls through a detailed cybersecurity assessment and review, and include security and privacy requirements to our contracts, where applicable. We also require that our third parties report material cybersecurity incidents to us, allowing us the ability to assess the impact of any reported incident on our operations. The Company's incident response plans include emergency response, systems recovery, and other plans that would be enacted in the event of certain types of cybersecurity attacks.


text: Our Board of Directors is responsible for oversight of risk management, including cybersecurity risks. The Audit Committee is updated on current cybersecurity events, metrics and other technology risks by our Vice President of Management Information Systems and Director of Infrastructure and Security on a quarterly basis, and all material risks and threats are reported immediately. The Audit Committee, in turn, provides the Board of Directors with updates regarding cybersecurity risks as it deems necessary or appropriate.


text: Our Internal Cybersecurity Team is comprised of the Director of IT Infrastructure and Security, Global Technical Support Manager, and includes Information Security Administrators and Team Members. This team is responsible for managing efforts to assess, detect, prevent, mitigate, and remediate cybersecurity risks, threats, and incidents. In addition, this team meets regularly with the IT leadership team to review current risks and trends, along with monitoring ongoing cybersecurity metrics.


text: Our cybersecurity incident response and vulnerability management programs are designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our VP of Management Information Systems, Director of IT Infrastructure and Security, General Counsel, Chief Financial Officer, and Chief Executive Officer. Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response and vulnerability management programs include reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.


text: For the fiscal year ended February 29, 2024, there have been no known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: HCW Biologics Inc.

ticker: HCWB


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: We have established physical, electronic, and organizational measures to safeguard and secure our systems to prevent a data compromise. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K is scheduled on 2024 IT plan; • requiring regular cybersecurity training programs for employees, management and directors; • comparing our processes to standards set by the National Institute of Standards and Technology ("NIST"); • leveraging the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • operating threat intelligence processes designed to model and research our adversaries; • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintaining copies of production data in two separate locations; • running a backup for our data on a daily basis and these files are held for several months; • testing the backup and recovery systems frequently; • employing a multi-factor authorization for employees who are working remotely, in order to mitigate risks of compromising email accounts; and • holding an insurance policy to mitigate risks for cybersecurity incidents. These approaches vary in maturity across our business and we work to continually improve them.


text: As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, including by annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate HCW personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigation.


text: As of December 31, 2023, we have experienced a few outages which we do not believe impacted the integrity of our data. While we continue to make investments to improve the protection of data and information technology, there can be no assurance that our efforts will prevent service interruptions or security breaches. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Data Privacy and Cybersecurity" included as part of our risk factor disclosures at Item 1A of this Annual Report, which disclosures are incorporated by reference herein.


text: To date, we have not experienced a material cybersecurity incident and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: Our Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Operations Administrator, who is supported by Compass MSP, a leading provider of technology managed services. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Executive Officer, who has founded and led several biotech companies for over 20 years, all of which have implemented systems and processes to protect sensitive clinical data and patient information. He is supported by our IT consultant, Compass MSP, a leading provider of technology managed services. Our consultant conducts a vulnerability assessment annually and tests our backup and recovery systems frequently.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools and third-party managed security services that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. We also evaluate the information security of potential partners and vendors as part of our selection process and attempt to negotiate adequate protections from such third parties when we enter into contracts with them. Although our security program is designed to identify, prioritize, assess, mitigate and remediate third party risks,, we rely on our partners and vendors to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: AGILYSYS INC

ticker: AGYS


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage tabletop exercises, penetration and vulnerability testing, and third-party red team exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an external auditor to conduct annual Security and Organizational Controls 2 (SOC 2) examination of the security controls for systems storing customer data. The external auditor also conducts an annual payment card industry (PCI) data security standard review of our security controls protecting payment information, as well as third-party penetration testing of our cardholder environment and related systems.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property, and we have experienced an unauthorized release of certain data. However, to date no cybersecurity incidents have had a material impact on our business, financial condition or results of operations, and we are not presently aware of any cybersecurity threats that are reasonably likely to materially affect us. Any significant disruption to our service or access to our systems could result in a loss of customer data and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a material adverse effect on our business, financial condition and results of operations. See "Risk Factors — Cyber-attacks involving our systems and data could expose us to liability or harm our reputation and have a material adverse effect on our business."


text: The Vice President and Chief Information Security Officer (CISO) leads the global information security organization responsible for overseeing our information security program. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies, and is a Certified Information Security Professional and Information Systems Security Architecture Professional. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. Given the nature of our business, management is highly focused on identifying and managing cybersecurity risks, and our CISO and information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.


text: The Board has primary responsibility for oversight of the Company's cybersecurity risks. The Audit Committee is also responsible for reviewing the Company's information and cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security, including results of periodic security assessments performed in conjunction with ongoing monitoring. The Audit Committee has formed a Cybersecurity Risk Subcommittee consisting of two independent directors to assist the Audit Committee in its oversight of cybersecurity risks. By its charter, all members of the Cybersecurity Risk Subcommittee must have a background or experience in information technology or cybersecurity and an understanding of cyber threats, risk mitigation and policy.


text: The results of our SOC2 and PCI assessments are reported to the Cybersecurity Risk Subcommittee. Both the Subcommittee and the Board receive regular reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. The Board also oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats.


text: The Company continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Director of Information Security (DIS), under the direction of our Director of Information Technology (DIT) continuously evaluates and addresses cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as National Institute of Standards and Technology frameworks.


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection safeguards; • Maintaining defined disaster recovery procedure and employing disaster recovery software, where appropriate; • Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external security support providers, including cybersecurity consultants, in evaluating, monitoring, and testing our cyber management systems and related cyber risks. The Company's collaboration with these third parties includes threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.


text: Risks from Cybersecurity Incidents To our knowledge, the Company has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, its operations, or financial standing.


text: The Company's cybersecurity risk management program is overseen by management at multiple levels. Under the direction of our DIT, the DIS plays a key role in assessing, monitoring and managing the Company's cybersecurity risks with the support of Company management, external cybersecurity consultants, as well as dedicated information technology and security personnel. Our DIS has 38 years of IT experience, 33 years of which are specializing in cybersecurity practices. Our DIS holds numerous certifications including as an ISC2, Certified Information Systems Security Professional (CISSP), and ISACA Certified Information Security Manager (CISM). Our DIS also has extensive experience in architecting, implementing, and managing cyber security control systems including vulnerability management, endpoint detection and response (EDR), security information and event management (SIEM), email fraud defense, and identity access management (IAM) solutions.


text: Monitor Cybersecurity Incidents Our DIT is continually informed and updated on the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. Our DIT, supported by our DIS, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan, which details immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: The Audit Committee of the Company's Board is responsible for overseeing the Company's cyber risk. Based on details provided by the DIT and DIS, the Chief Financial Officer (CFO) provides the Audit Committee quarterly updates that encompass a broad range of topics, including: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; and • Compliance status and efforts with regulatory requirements and industry standards.


text: In addition, the CFO provides updates to the full Board upon request, and timely updates regarding unique developments such as regulatory updates or vulnerability developments, based on details provided by the DIT and DIS.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal IT Risk Register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes on an as needed basis; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • tabletop exercises conducted by outside counsel periodically to evaluate our incident response plan and response capabilities; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to our Information Technology, Intellectual Property, and Data Security and Privacy."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of risk assessment and risk management, including cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and emerging threats; • progress on cybersecurity projects; • incident reports; • lessons learned from past events; and • adherence to regulatory requirements and/or industry standards, as appropriate.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Digital and Information Officer.


text: Our management team, including our Chief Digital and Information Officer and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Digital and Information Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital and Information Officer has more than 30 years of experience in information technology, including prior experience in cybersecurity architecture. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our information security and cybersecurity program is based on a cybersecurity framework that is designed to protect against operational risks related to cybersecurity.

companyName: CORVEL CORP

ticker: CRVL


text: We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of company information, and data entrusted to us by our customers. We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical controls designed to protect the security and privacy of confidential, personal, and proprietary information. We conduct regular assessments, measuring our exposure to cyber threats. These assessments form the basis for our cyber risk program. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. Our Chief Information Security Officer ("CISO") is responsible for overseeing and implementing our cybersecurity program and enforcing our cybersecurity policy. We employ internal dedicated security personnel and also have contracted services delivered from a full-service Managed Security Service Provider. Our Chief Technology Officer ("CTO) oversees the day-to-day security operation, and our Chief Information Officer ("CIO") oversees our secure development activities.


text: Our CISO leads our enterprise information security, privacy, and cybersecurity program, which is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our partners or our customers. We have implemented an industry adopted cybersecurity framework, which is continuously improving. We continuously test and assess our cybersecurity posture, including third-party risk assessments performed by reputable assessors, consultants, and auditors. Additionally, we perform an annual evaluation of our cybersecurity program.


text: The Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a Cybersecurity Incident Response Plan which contains processes and procedures related to security incident handling.


text: We also have vendor assessment processes to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our agreements with third parties may include various compliance requirements, data protection terms, audit or monitoring rights, and notification requirements in the event the third party experiences its own cybersecurity event.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our information security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes). This training is mandatory for all employees and is supplemented with periodic social engineering tests.


text: We engage consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. In the last three fiscal years, we have not experienced any material cybersecurity incidents or costs.


text: As stated above, the Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our CISO, who reports to the Chief Executive Officer ("CEO"), is responsible for providing annual updates to the Board of Directors and to executive leadership. In addition, our CISO partners closely with our CIO and CTO and their respective organizations to execute defined functions within our cybersecurity program. Our CISO, CIO, and CTO each report directly to the Chief Executive Officer ("CEO") who, as appropriate, will escalate any cybersecurity issues to the Board. Our CISO and CIO both attend regular meetings with the executive officer team, including our CEO, Chief Financial Officer and other senior executive officers, and report on cybersecurity matters as appropriate.


text: Our cybersecurity and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. Such leaders in our organization hold industry recognized certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) and Global Information Assurance Certification (GIAC).


text: Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibility and has delegated responsibility for oversight of this risk to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. The Audit Committee oversees our enterprise risk assessment process, and cybersecurity represents an important component of our overall approach to risk assessment. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Champion Homes, Inc.

ticker: SKY


text: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, our Vice President ("VP") of Global Technology, and other members of management.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Planning: We have established and maintain an incident response plan that outlines our response in the event of a cybersecurity incident.


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. In addition, we regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We review and evaluate material cybersecurity risks related to the use of third parties, including vendors, service providers and other external users of our systems.


text: We provide regular training regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: The Audit Committee receives regular presentations and reports from our VP of Global Technology on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Audit Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the risk assessment process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: The VP of Global Technology, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Risks Related to Information Technology" in Item 1A. Risk Factors.


text: Viasat Cybersecurity Risk Management, Strategy and Governance Disclosure Viasat builds, maintains, and operates satellite and telecommunications systems, infrastructure and services used by both government and commercial customers across the globe. We recognize the importance of building a resilient cybersecurity program focused on reducing cybersecurity risk to our customers, partners and our own organization. Our Cybersecurity Engineering organization, at the direction of the Board of Directors, has developed and implemented a cybersecurity risk management and technical assistance program intended to protect the confidentiality, integrity and availability of the services provided and the information stored, processed or transmitted by our critical systems and infrastructure, while assisting staff to develop, operate and maintain secure products and services.

companyName: VIASAT INC

ticker: VSAT


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated governance of cybersecurity and other technology risks to the Audit Committee (the Committee). Our management is ultimately responsible for assessing and managing risks from cybersecurity threats we face, and in this regard works closely with the Chief Information Security Officer (CISO) who reports to our Chief Corporate Officer. The Committee oversees our management's design and implementation of our cybersecurity risk management program and receives periodic reports, at least semi-annually, from the CISO on cybersecurity risks, the threat landscape, and our cybersecurity planning roadmap. In addition, the CISO updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as other relevant incidents and potential or mitigated threats. The Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity, and may request the CISO brief the Board of Directors on the status of cybersecurity and risk management programs, as well as relevant incidents and threats. Board members also receive periodic presentations on key cybersecurity topics from the CISO.


text: Our operational cybersecurity team is led by the CISO. The CISO has 31 years of experience in Information Technology and Security, with extensive experience designing, operating and protecting satellite and terrestrial telecommunications networks. The CISO also leads Viasat's engagement with the private sector and government security communities, which includes facilitating active information sharing with these partners. With the Inmarsat acquisition, the Senior Vice President, Global Security of Inmarsat joined the cybersecurity team, bringing their experience including senior cybersecurity and intelligence roles within the UK Ministry of Defence and Central Government. The operational cybersecurity teams of both legacy organizations jointly participate in local and national cybersecurity organizations, teach classes on cybersecurity, maintain numerous relevant certifications, and participate in training relevant to their field of expertise.


text: The cybersecurity risk management program at Viasat is centered around an internally developed set of security principles and requirements, known internally as our "Foundational Security Principles". The Foundational Security Principles, which we seek to apply across our products and services to promote security resiliency and repeatability, represents a minimum baseline of information security requirements. These principles have a focus on secure-by-design approaches for new products and services, and provide the basis for risk-informed control implementations for legacy networks and systems. Our Foundational Security Principals are designed with reference to the current published version of industry frameworks including, but not limited to, NIST Cybersecurity Framework 2.0, International Standards Organization (ISO) 27001, Payment Card Industry (PCI) Data Security Standard (DSS), National Institute of Standards and Technology (NIST) 800-171, and tailored baselines of NIST 800-53. This does not imply that we have implemented each, or any specific, technical standard, specification or configuration embedded in these frameworks but rather that they collectively inform and guide our indentification, assessment and management of cybersecurity risks relevant to our businesses. Certain IT environments with higher risk or contractual, regulatory or customer requirements, or those environments where processing or storing sensitive types of information are required, are designed to comply with stricter sets of security requirements or security control frameworks.


text: We recognize our recent acquisition of Inmarsat represents an opportunity to build on the existing cybersecurity risk programs incorporating and integrating the strengths of both legacy cybersecurity organizations. The Inmarsat Cybersecurity Team has historically been guided by the NIST Cybersecurity Framework. The legacy Viasat and Inmarsat cybersecurity organizations will report to Viasat's CISO and are actively integrating the two legacy companies' cybersecurity policies, processes, and operations, as well as combining the cybersecurity functions into a single organization, with appropriate focus on the overall Viasat and Inmarsat satellite service network integration activities.


text: Functionally, our cybersecurity team performs internal and external risk assessments and testing on both internally and externally developed systems, as well as certain third-party and supply chain partner ecosystems based on our assessment of their respective operational criticality and risk profile. Depending on the risks presented, this may include some combination of manual and automation-driven testing methods and supply chain risk management activities such as hardware and software assurance assessments, anti-counterfeit measures, and the use of trusted suppliers. Compliance with security policies, procedures, and standards are assessed, and depending on the potential risks posed to us, third-party assessments may be performed, including penetration tests, red team engagements, gap assessments, and compliance certification assessments. We also conduct several 3rd party compliance and audit assessments, including PCI DSS Tier 1 Merchant and Service Provider, ISO 27001, UK Cyber Essentials Plus, and DFARS 252.204-7012 High Assurance assessments.


text: The cybersecurity team also closely collaborates with our physical security team on planning, risk assessment, and incident response where appropriate, as well as developing and delivering a joint annual security training and education program that engages our employees, appropriate partners and third parties in a security training program that incorporates both cybersecurity and physical security elements. Additionally, our annual security training program supports additional focused security training for personnel handling certain sensitive information such as, payment card information (PCI), controlled unclassified information (CUI), or personally identifiable information (PII).


text: To better understand Viasat's threat landscape we partner with multiple U.S. government agencies to acquire and share cybersecurity threat intelligence related to threats, vulnerabilities, indicators of compromise, and current, relevant threat information that are expected as a cleared defense contractor and active Defense Industrial Base (DIB) member. Partner entities include the Defense Cyber Crime Center (DC3), Defense Cybersecurity Information Sharing Environment (DCISE), DCMA, National Security Agency Cybersecurity Collaboration Center (NSA CCC), and Defense Counterintelligence and Security Agency (DCSA). Viasat is also an active participant in several Information Sharing and Analysis Centers, including the National Defense (ND-ISAC), Aviation (A-ISAC), and Space (Space ISAC) ISACs.


text: Our cybersecurity engineering teams have personnel dedicated to detection engineering activities that leverage threat intel gathered to mitigate the impact of security events. Security detection and operations teams are responsible for detection activities including 7x24 staffed Cybersecurity Operations Centers responsible for monitoring our service provider networks and internal corporate and development environments. Various automated tools are used for detection and remediation, with support from experienced detection and response analysts and engineers.


text: When security events do occur, we employ a security incident response process that is designed to contain, eradicate, and recover operations as quickly as possible, while preserving forensic evidence for further analysis and potential attribution. We leverage multiple third parties for incident response and forensic support on retainer as necessary to assist during the incident response and remediation phases. We also maintain cybersecurity insurance in the event of cybersecurity related damages or data loss as a result of a cybersecurity incident or unauthorized data disclosure.