text: As a part of the cybersecurity program, we conduct assessments, both internally and by independent third parties, to identify and prioritize the mitigation of cybersecurity risks. We also maintain a formal and mandatory cybersecurity awareness training program for all employees that includes annual training on information security best practices in high risk areas such as phishing and authentication. Additional role-based training is provided to finance team members, due to the elevated privilege and risk associated with their duties. All employees are also tested periodically for their cybersecurity awareness.


text: We rely on information technology systems and infrastructure for many of our business and internal processes. Some of these systems and infrastructure are managed by third-party service providers who are not under our direct control. In order to mitigate material risks from our critical finance-related third-party service providers, we annually review their SOC1 reports for any noted material incidents and risks.

companyName: Third Harmonic Bio, Inc.

secItem: Item 1C


text: For our non-finance service providers, we are currently implementing cybersecurity controls, including but not limited to requiring all critical vendors to notify us should the vendor fall victim to, and become aware of a material cybersecurity incident, and reviewing any available SOC2 or similar compliance reports should they be available. Our vendor selection and management processes include the assessment of vendors' cybersecurity controls.


text: While tools and processes are in place to mitigate cybersecurity risks, we are continuing to establish an Incident Response Plan, or IRP, to analyze, contain, and remediate any cybersecurity incidents which may occur despite these mitigations. The IRP, based on the National Institute of Standards and Technology framework, defines a timely, consistent, and compliant response to cybersecurity incidents and includes notifications to the Audit Committee and any relevant governing bodies such as the SEC in the event that the cybersecurity incident is deemed to be material.


text: Although we have implemented a cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our information systems and assets, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber incidents. However, it is important to note that although we maintain cybersecurity insurance, there can be no guarantee that the insurance will cover us, wholly or partially, from potential liabilities, or that such insurance proceeds will be paid to us in a timely manner.


text: While we are not aware of any significant cybersecurity incidents that have occurred to date, we are exposed to, and may in future be adversely impacted by cyberattacks and interruptions to our information technology systems and infrastructure. Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, and/or result in the loss of trade secrets, proprietary information, or competitively sensitive data.


text: We seek to maintain a robust and continuously improving cybersecurity program however the impact of certain cybersecurity incidents could have a materially adverse impact on our competitive position, reputation, operations and/or financial position. We remain vigilant in continuously improving our cybersecurity program and its controls.


text: Governance and Management's Responsibilities IT management is responsible for the cybersecurity program that assesses and manages cybersecurity risk. Specifically, our Director, IT Infrastructure & Cybersecurity is responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents while at the executive level, the Chief Administrative Officer oversees the program and is the executive sponsor.


text: Our Director, IT Infrastructure & Cybersecurity monitors cybersecurity incidents and does so by working closely with expert technology and security partners. We and our partners deploy a variety of technologies and processes, including but not limited to intrusion monitoring, detection and response, patch management, threat hunting, identity and access management, assessments, audits and tests.


text: Our Director, IT Infrastructure & Cybersecurity has relevant expertise in cybersecurity having spent the previous two years prior to joining the Company building a SOX compliant IT controls framework for a biotechnology company in preparation for its initial public offering. Prior to that, our Director, IT Infrastructure & Cybersecurity spent five years at a publicly traded pharmaceuticals company, where he was responsible for the SOX cybersecurity and compliance of systems, processes, and policies. In addition to SOX compliance, our Director, IT Infrastructure & Cybersecurity has extensive experience with other compliance frameworks, including National Institute of Standards and Technology (NIST), HIPAA, Clinical Laboratory Improvement Amendments (CLIA), and GxP security models.


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect us, including its business strategy, results of operations or financial condition.


text: We have implemented a cybersecurity risk management program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework and International Organization for Standardization 27001 Framework.

companyName: Septerna, Inc.

ticker: SEPN


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to written information security policies, external cybersecurity risk assessments, and system monitoring. We also have an employee privacy and data security training awareness program that includes cybersecurity risk awareness trainings and phishing campaigns. We maintain an incident response plan to help guide our response to cybersecurity incidents.


text: We leverage the cybersecurity services of third-party vendors, including a third-party managed services provider and IT consultants, to support our cybersecurity risk management program and assist us in conducting external cybersecurity risk assessments. As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors. As part of our vendor diligence process we require vendors with access to our information technology systems and infrastructure to complete information security program questionnaires.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats relating to our and our third-party vendors' information systems and infrastructure. For more information, please see "Item 1A, Risk Factors."


text: Related to Cybersecurity Risks Our board of directors has delegated cybersecurity risk management to our Audit Committee as part of the Audit Committee's general risk oversight function. The Audit Committee, through the oversight of the General Administrative Leadership team, is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our General Administrative Leadership team, which consists of our CEO, CFO, COO, CPO, Vice President of Finance and Business, Vice President of Technology and our Head of Information Technology ("IT"), and is responsible for the strategic leadership of our cybersecurity risk management program. Our Head of IT, who also serves as our Information Security Officer, is responsible for the day-to-day management of our cybersecurity risk management program. The individual who is currently in this role has over thirty years of experience in information technology and cybersecurity risk management. Our Head of IT relies on both internal and external cybersecurity resources to manage and remain appraised of overall cybersecurity risks to our business and our industry.


text: The General Administrative Leadership team provides regular briefings regarding cybersecurity risk and related matters to our Audit Committee. Such briefings may include a discussion of cybersecurity risks and applicable risk assessments, key updates regarding our cyber strategy and related initiatives, and the emerging cybersecurity threats that may impact our business. We also provided the full board of directors with updates on matters relating to cybersecurity risk management, as necessary.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which is overseen by an internal information technology specialist. Cybersecurity threats are identified and escalated to a member of management pursuant to criteria set forth in these processes.

companyName: Sow Good Inc.

ticker: SOWG


text: The audit committee of the board of directors (the "Audit Committee") is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Company's board of directors, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the Audit Committee's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, the Company's cybersecurity processes have been integrated into the Company's overall processes.


text: The Audit Committee operates under a written charter adopted by the Company's board of directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats.


text: The Audit Committee is informed of material risks, if any, from cybersecurity threats pursuant to escalation criteria set forth in the Company's disclosure controls and procedures. Further, at least once per quarter, a member of the Company's Audit Committee reports material risks, if any, from cybersecurity threats to the Company's board of directors. The Company's management team also assesses and manages material risks, if any, from cybersecurity threats.


text: The Audit Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, including controls and procedures related to managing material risks from cybersecurity threats, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Company's board of directors, as appropriate, to allow for timely decisions regarding such disclosures.


text: The Company's Information Technology Manager oversees the Company's incident response plan and related processes designed to assess and manage material risks, if any, from cybersecurity threats. The Information Technology Manager also coordinates with any consultants, auditors and other third parties to assess and manage material risks, if any, from cybersecurity threats.


text: The Company's Information Technology Manager is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes. The Company's Information Technology Manager is also informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to notification criteria set forth in the Company's contracts with third-party service providers. Further, the Company's Information Technology Manager is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to reports prepared by consultants, auditors, and other third parties retained by the Company, if necessary, to investigate cybersecurity incidents.


text: The Company's Information Technology Manager informs the Audit Committee of cybersecurity incidents that may be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes.


text: The Company's Information Technology Manager or a delegate thereof also prepares a report for the Audit Committee and the Company's board of directors concerning material risks, if any, from cybersecurity threats at least once per quarter, and more often to the extent necessary pursuant to the escalation criteria set forth in the Company's processes described herein.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information concerning risks related to cybersecurity, see Item 1A. Risk Factors.


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


text: Cybersecurity Risk, Management, and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Bank's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition.

companyName: BV Financial, Inc.

ticker: BVFL


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes advanced employee training, innovative technologies, and policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third Party Risk Management, and Incident Response.


text: Core activities supporting our strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees are the first line of defense against cybersecurity measures. Every employee is responsible for protecting Bank and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Our employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, vulnerability scanning, third-party monitoring, and threat intelligence.


text: Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a Third-Party Risk Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data.


text: As indicated above, supporting our operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. Accordingly, the Company engages third-party consultants and independent auditors to conduct penetration tests, external audits, program enhancement where applicable and review of cybersecurity risk assessments.


text: The Company has established an Information Technology Steering Committee consisting of department leaders. The committee focuses on strategic and tactical delivery as well as policy oversight. All such policies are approved by the board of directors. All Information Security activity is led by the Information Security Officer.


text: We have implemented and maintain information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial data ("Information Systems and Data").

companyName: CalciMedica, Inc.

ticker: CALC


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and disaster recovery plan, disaster recovery testing, data encryption for certain data, asset management, system monitoring and multi-factor authentication for certain systems, employee training and cybersecurity insurance.


text: We use a third-party information technology consultant to help identify, assess and manage the Company's cybersecurity threats and risks. This consultant reports to and works with our management team, including our Chief Scientific Officer and President and Chief Operating Officer to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools including for example by subscribing to reports and services that identify cybersecurity threats, leveraging certain system monitoring tools, and leveraging tools provided through Microsoft Office 365.


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our senior management works with our information technology consultant to evaluate material risks from cybersecurity threats against our overall business objectives.


text: We use third-party service providers, including cybersecurity consultants, to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations, contract manufacturing organizations, and other third-party service providers. We review the cybersecurity risks associated with the use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment and due diligence designed to help identify cybersecurity risks associated with a vendor, as well as the imposition of security related contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " Our information technology systems, or those of our CROs, contractors, consultants, or other third parties with whom we work, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business. "


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Scientific Officer, President and Chief Operating Officer, Chief Financial Officer, Vice President Finance and General Counsel who also serves as our compliance officer. These members of management have prior work experience in various roles involving managing information security programs and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents.


text: Our Chief Scientific Officer and our President and Chief Operating Officer are responsible for engaging appropriate personnel and companies, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant employees and personnel. Our President and Chief Operating Officer is also responsible for managing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: We have adopted a Cybersecurity Incident Response Policy which is designed to escalate certain cybersecurity incidents to a Cybersecurity Incident Management Team consisting of our Chief Scientific Officer, President and Chief Operating Officer, General Counsel and our information technology consultant. Depending on the circumstances, cybersecurity incidents are reported to our Chief Executive Officer and Chief Financial Officer. Senior management works to help the Company mitigate and remediate cybersecurity incidents of which they are notified in addition to notifying the Audit Committee of the Board of Directors, as appropriate.


text: The Audit Committee of the Board of Directors receives periodic reports as needed from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a written data security incident response policy and a security incident response plan, which were first developed in 2017 and are periodically reviewed and updated.

companyName: LANDS' END, INC.

ticker: LE


text: We have designed and assessed our program using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to our legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • a written data security incident response policy and a security incident response plan that include detailed procedures for responding to cybersecurity incidents, determining severity of cybersecurity incidents and notifying appropriate internal and external parties; • third-party and internal risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team consisting of members of our information technology department, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • periodic tabletop exercises involving the security team, the data security incident management team, and members of management, with special sessions for the Board of Directors; • annual audit by a Payment Card Industry ("PCI") qualified security risk assessor to validate our PCI-Data Security Standard ("PCI-DSS") compliance; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • regular cybersecurity awareness training, including social engineering and phishing testing of our employees, incident response personnel, and senior management; • deployment of external tools designed to detect and protect against spam, malware and other cybersecurity threats and train personnel; and • third-party security event monitoring.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be adequate, fully complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – RISKS RELATED TO INFORMATION TECHNOLOGY, CYBERSECURITY AND DATA PRIVACY."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of data protection and cybersecurity risks as part of the Audit Committee's oversight of the Company's enterprise risk management framework. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity.


text: The Audit Committee receives regular reports from management on our cybersecurity risks, which include updates on trends and threats, the Company's backup and restore systems, internal and external risk assessments, results of PCI and other security audits, and planned updates and upgrades. The Audit Committee also receives regular enterprise risk management updates, which include management of cybersecurity risks.


text: In accordance with our data security incident response plan, management is required to promptly update and discuss with the Audit Committee any material or potentially material cybersecurity incidents and provide an update to the Board upon determination that an incident is material. Management regularly updates the Audit Committee regarding incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, Chief Technology Officer and General Counsel (the cybersecurity disclosure committee), is responsible for assessing material risks from cybersecurity threats and our General Counsel oversees any required reporting obligations and notifications. Our Chief Technology Officer has primary responsibility for overseeing our security incident response plan, including identification and initial assessment of threat levels and escalations.


text: Critical incidents are escalated to a cross functional data security incident management team for review, which then escalates potentially material incidents and threats to the cybersecurity disclosure committee for determinations of materiality and Audit Committee and Board communications. Our Chief Technology Officer has over 20 years of experience with cybersecurity management response, and multiple direct reports who have 10 or more years of experience leading technology infrastructure and security incident response. Our General Counsel has over eight years of experience leading our incident response management team.


text: Our Chief Technology Officer is the primary point of responsibility for cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity technologies, and controls and processes to aid in our efforts to assess, identify, and manage such risks.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: We are subject to cybersecurity threat risks associated with our use of third-party service providers, including independent clinical investigators, contracted laboratories and contract research organizations. Cybersecurity considerations affect the selection and oversight of these third-party service providers.


text: We engage certain external parties, including cybersecurity and privacy firms and consultants, to provide IT support and cybersecurity oversight, and enhance our risk reduction abilities, including the engagement of a third-party to review our cybersecurity program to help identify areas for continued focus and improvement. We also use automated tools designed to monitor, identify, and address cybersecurity risks.


text: As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. We have a formalized incident response policy in place. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," of this Annual Report.


text: Our Head of Information Technology, who reports directly to the Chief Operating Officer, has day-to-day responsibility for preventing, mitigating and remediating cybersecurity threats and incidents. The individual currently serving in this role has two decades of experience in information technology and cybersecurity. Our Disclosure Committee evaluates the materiality of any threats and/or incidents to determine if there is any required disclosure. Our external SEC counsel is also apprised of certain threats and/or incidents that may occur and is available to advise management on any disclosure obligations.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Periodically, the Audit Committee receives an overview from our Head of Information Technology of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by and incorporates elements of recognized industry standards. Our cybersecurity risk management strategy is guided by both internal cybersecurity risk assessments and third-party information security audits.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: We leverage the support of third-party information technology and security providers as part of our cybersecurity risk management program, including for penetration testing. Further, we have adopted written information security policies and procedures, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. Additionally, the Company's employees go through cybersecurity awareness training covering topics such as general cybersecurity best practices, phishing, data protection, password protection, and network security.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could effect our information or systems. For more information, please see the section entitled "Risk Factors".


text: Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee (the "InfoSec Committee"). The InfoSec Committee is currently made up of a cross-disciplinary team, including the Company's acting Chief Information Security Officer (CISO), Chief Legal Officer, VP of People, Senior Director of R&D & Engineering, VP of Global Marketing, Medical Affairs and our Senior Corporate Counsel. The InfoSec Committee meets on a monthly basis to provide oversight of the Company's information security management system ("ISMS"), review the performance and effectiveness of the ISMS, and review and discuss the direction of the Company's cybersecurity program, among other responsibilities. The committee also performs an annual audit to ensure Allurion's ISMS is effectively implemented and maintained. Our acting CISO, who is also our VP of Software Engineering, is responsible for the day-to-day oversight of the assessment and management of our information security program and cybersecurity risks. The individual who is currently in this role has approximately 25 years of experience in information technology.


text: The Board also engages in oversight of cybersecurity risks. With the input of the InfoSec Committee, our CISO may provide periodic updates to the Board on matters related to cybersecurity as needed.


text: Cyber Risk Management and Strategy We, under the oversight of the Audit Committee of our board of directors, have implemented and maintain an enterprise risk management process, which includes periodic assessments of various risk categories, including cyber risks, across our Company. Our process for assessing, identifying, and managing risks from cybersecurity threats is informed by industry standards and supported by cybersecurity technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address cybersecurity risks.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: We leverage a managed security service provider and also engage with other third-party providers and consultants to support our cyber risk management efforts, including through periodic security testing. We have a process to assess and review the cybersecurity practices of information technology third-party vendors and service providers, including through review of applicable certifications, security reports, and vendor questionnaires and contractual requirements, as appropriate.


text: Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Head of IT in consultation with the legal team and our third-party security advisor. Currently, our Head of IT role is held by an individual who has over 20 years of information technology experience. The Head of IT reports to our Chief Financial Officer.


text: Our Head of IT meets with our Chief Financial Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from our third-party technology providers, as appropriate. In addition, our Head of IT has regular meetings with our managed security service provider to inform our cyber risk management processes and reporting to management. Our Head of IT, working with our Chief Financial Officer, provides periodic reports on cybersecurity and information technology matters to our Audit Committee, which assists our board of directors in reviewing and overseeing our risk management process, including cybersecurity risks.


text: Our Chief Financial Officer and our Audit Committee periodically report on cybersecurity risk management to the full board of directors. Our board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including cybersecurity risks.


text: Our enterprise risk management program is overseen by a risk management committee comprised of senior management across key functional areas inclusive of cybersecurity and information technology matters. This committee, working with our Chief Financial Officer, provides periodic reports and updates, as needed, to our board of directors or our Audit Committee. In collecting information on enterprise risk, cybersecurity is included as a designated risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the Audit Committee and among senior management on a periodic basis.


text: Material Effects of Cybersecurity Incidents Except as disclosed in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K, including, without limitation, the risk factor under the heading "If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors or consultants upon which we rely, are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including, but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related to our business, and other adverse consequences", risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer, as discussed below, quarterly to the Information Technology Committee and annually to our board of directors.

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our system or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence fees to facilitate and promote program effectiveness. Our Information Technology Director, who reports directly to our Chief Operating Officer and the Chief Information Security Officer, who report directly to our board of directors, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and reliance tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using third-party cybersecurity experts. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the board of directors. The Incident Response Plan is coordinated through the [Information Technology Officer] and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company.


text: Our Chief Information Security Officer is accountable for managing our enterprise information security function and delivering our information security program. The responsibilities of this position include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Technology Director, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Operating Officer. The function, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals responsible, including third-party vendors, are generally subject to professional education and certification requirements.


text: Our board of directors has approved management committees including the Information Technology Committee, which focuses on technology impact, and its business impact. This committee provides oversight and governance of the technology program and the information security program. This committee is chaired by the Information Technology Director and includes the Chief Information Security Officer, the Chief Operating Officer, and the Chief Risk Officer. This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the board of directors on an annual basis (or more frequently as may be required by the Incident Response Plan).


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Technology Director and Chief Information Security Officer provide annual reports to the board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the board of directors reviews our cybersecurity risk profile on a quarterly basis.


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data. We have integrated cybersecurity risk management into our broader risk management framework. Our digital and technology organization outside the Company continually addresses cybersecurity risk in alignment with our business objectives and operational needs.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT


text: Our cybersecurity program is focused on the following areas: • Governance: We leverage multiple cybersecurity frameworks (e.g., ISO 27001 and NIST CSF) and regulatory requirements to inform our externally managed information technology ("IT") infrastructure. Policies for IT use and management for each employee are part of the employee onboarding process and those policies are refreshed periodically as threats emerge that could be relevant to our IT infrastructure. • Technical Safeguards: The Company does not use a centralized server where all information is stored and therefore where all information is placed at risk. Instead, we deploy technical and procedural measures using a distributed model so that no one location or machine could cripple the company's IT infrastructure. Protection measures include network firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments and monthly risk assessments and management, threat intelligence, anti-malware and access controls, plus data loss prevention and monitoring. • Security Awareness / Training: All employees are required to adhere to our Standards of Business Conduct, which identifies an employee's responsibility for information security. We also disseminate security awareness information periodically throughout the year. • Third-Party Suppliers and Service Providers: We manage our IT infrastructure with an external vendor who maintains and evaluates risk exposure in real-time and conducts monthly risk assessments and adjustments to preclude cyberattacks. Vendor security reviews evaluate numerous key security controls and the outputs of these reviews are used as part of business decisions regarding storage and dissemination of virtual data and to assess a vendor's overall security posture.


text: Risks from Cybersecurity Threats While we are subject to ongoing cybersecurity threats, the risks from these threats have not materially affected, or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, see "Item 1A. Risk Factors-Risks Related to Our Operations" in this Annual Report.


text: Board Oversight of Cybersecurity Risks Our Board is responsible for the oversight of our risk management program and regularly reviews information regarding our most significant strategic, operational, financial, legal and compliance risks, including cybersecurity risks. The Board reviews mitigation plans through discussions with management, which includes regular Board reports and findings from management's monthly discussions with our outside IT group. Our Board of Directors also reviews and approves our cybersecurity policies, strategies, and budgets on an annual basis.


text: Our CEO in conjunction with our external IT team are responsible for setting the strategy and communicating cybersecurity risks. With the Company's distributed model of data storage, risks have been limited and the Company has not experienced a cybersecurity breach. The Company's security measures and monthly system audits to identify potential vulnerabilities and remediate deficiencies in real time.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, hardware, software, and our high value data, including intellectual property, trade secrets, confidential and sensitive information (collectively, "Information Systems and Data").

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Our management team works with our digital transformation team in an effort to identify, assess and manage the Company's cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage, mitigate and remediate material risk from cybersecurity threats to our Information Systems and Data. These measures include but are not limited to firewalls, endpoint detection and response, antivirus programs, email security measures, backups and recovery procedures, privileged access management, multi-factor authentication schemes, data encryption, automatic patching, and security system information event monitoring to detect and respond to any emerging threats. Our information security and privacy policy framework includes standards for incident response, vulnerability management, data protection and logical access controls.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our Company's overall risk management process, which, in part, establishes intended uses of our computerized systems and identifies critical and/or material risks. After a system reaches operation, the risk management approach continues following processes for change control, system maintenance, logical access control, discrepancy management and periodic review.


text: We use independent service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats. We periodically conduct vulnerability assessments and perform intrusion and penetration testing to evaluate our cybersecurity response capabilities.


text: We maintain cybersecurity awareness training for our employees and periodically perform phishing simulations. We routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques and how to avoid them, and the best use of our established communications channels.


text: We have a vendor management process designed to manage cybersecurity risks associated with our use of third parties. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve varying methods of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under "Part I, Item 1A. — Risk Factors" in this Annual Report on Form 10-K, including the risk factor titled "If our information technology systems, or those of third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, significant fines or other liability, interruptions of our development programs, harm to our reputation, and other adverse consequences."


text: The Nominating and Corporate Governance Committee of our Board of Directors is responsible for overseeing cybersecurity risk management processes, including oversight and mitigation of risk from cybersecurity threats. The Nominating and Corporate Governance Committee receives reports, as necessary, from the Chief Financial Officer of the Company regarding cybersecurity threats or incidents.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our digital transformation team under the supervision of the Chief Financial Officer and Chief Executive Officer of the Company, both of whom have experience in business operations including risk management and oversight of information technology functions within the biopharmaceutical industry. Our digital transformation team includes members with relevant expertise in cybersecurity, incident response, and the safeguarding of company assets. The digital transformation team undertakes efforts to learn about the Company's cybersecurity threats by reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management follow our information security and privacy policy framework. This framework is designed to escalate certain cybersecurity incidents to the Chief Financial Officer and, depending upon an incident's particular facts, the Chief Financial Officer will report certain cybersecurity incidents to the Nominating and Corporate Governance Committee of the Board of Directors.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, including enforcing single sign-on or multi-factor authentication where supported or appropriate. We engage third-party cybersecurity experts to assess the security of our network. In addition, we engage a third-party to perform internal audits of our IT General Controls (ITGCs).

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is designed to be integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee (the Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors may also receive briefings from management on our cyber risk management program. Board members may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO), internal security staff or external experts as part of the board of director's continuing education on topics that impact public companies. Our IT Senior Director, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our IT Senior Director has primary responsibility for our overall cybersecurity risk management program, and our IT Senior Director supervises our retained external cybersecurity consultants. Our IT Senior Director has over 25 years of IT and cybersecurity experience.


text: Our IT Senior Director takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Strategy We have established and currently maintain processes designed to assess, identify and manage risks from cybersecurity threats to, among other things, our critical computer networks, third party hosted services, communications systems, and our critical and sensitive data. These cybersecurity processes are designed to secure our networks and information systems and protect our operations and information assets from unauthorized access or attack. Such cybersecurity processes include technical, procedural and organizations safeguards that are built into our overall information technology ("IT") function. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. As discussed in more detail under "Cybersecurity Governance" below, the audit committee of our Board of Directors provides oversight of our cybersecurity risk management and strategy processes, led by our Head of IT.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Our approach to cybersecurity is tailored to suit the specific environment in which we operate and is based on recognized frameworks established by applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our approach includes a comprehensive strategy featuring a risk management team lead by our Head of IT and a regularly tested incident response plan. We also identify our cybersecurity threat risks by comparing our processes to industry standards, as well as by engaging third party experts to conduct risk assessments, tabletop exercises, threat modeling, and vulnerability testing.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. Our incident response plan requires that suspected cybersecurity incidents are promptly reported to our Controller and Chief Human Resource Officer and includes an escalation path to our Chief Executive Officer, executive leadership team, and Board of Directors.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and are not aware of any cybersecurity incidents at third parties with whom we conduct business that may have impacted us.


text: Cybersecurity Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. In general, our Board of Directors oversees risk management activities designed and implemented by our management. Our Board of Directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our Board of Directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: Our audit committee receives periodic updates from management on our cybersecurity processes. The audit committee receives information regarding current and emerging material cybersecurity threat risks and our ability to mitigate those risks. Our Board of Directors receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our Head of IT, who leads our cybersecurity risk management and strategy processes, has over ten years of information technology and cybersecurity work experience. This risk management team member is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information, or collectively Information Systems and Data.

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: Our cybersecurity function, which comprises, in part, our information technology team, helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting threat assessments for internal and external threats, conducting scans of the threat environment, evaluating our (and our industry's) risk profile, using external intelligence feeds, conducting vulnerability assessments to identify vulnerabilities, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, an incident response plan, a vendor risk management program, employee training, data encryption, access controls, physical security, network security controls, systems monitoring, cyber insurance, and asset management, tracking, and disposal.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intel service providers, and cybersecurity software providers. We also use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, application providers, contract research organizations, supply chain resources, and contract manufacturing organizations. We manage cybersecurity risks associated with our use of these providers by conducting audits and risk assessments on certain vendors, requesting and analyzing responses on a security questionnaire, and reviewing relevant reports.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "—If our information technology systems or those third parties upon which we rely or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.".


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Senior Director of Information Technology, who has over 23-years of experience in IT management (including cybersecurity) and a degree in Computer Information Systems.


text: Our Senior Director of IT, as part of our overall cybersecurity function, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer, or CFO, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other significant security-related incidents.


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the CFO. Our CFO and Senior Director of IT work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the board of directors committee responsible for certain cybersecurity incidents.


text: The audit committee receives an annual update from our cybersecurity function concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. In addition, they receive timely notifications of significant cybersecurity incidences based on our cybersecurity response plan. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and employees ("Information Systems and Data").

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: Our information security function is led by our Chief Financial Officer & Head of Corporate Strategy ("IT Lead"), who reports to our CEO and is supported by our third party security provider, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example analyzing report of threats and threat actors and conducting periodic vulnerability assessments for certain systems. Our assessment and management of material risks from cybersecurity threats are considered as part of our risk management processes. For example, our IT Lead and certain management, including our CEO, evaluate identified material risks from cybersecurity threats against our overall business objectives and our IT Lead periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments for certain systems, systems monitoring for certain systems, access controls, asset management, and employee training. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example our managed security provider and professional services firms, including legal counsel.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including that if our information technology systems or those of third parties upon which we rely, or our data, are or were compromised, we could experience adverse consequences, including disclosure of sensitive information, damage to our reputation, and significant financial and legal exposure.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the IT Lead. The IT Lead has 4 years of experience in roles that include oversight of cybersecurity risk management programs.


text: Our IT Lead is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our IT Lead concerning cybersecurity issues, including certain threats and risks and the processes the Company has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We continue to assess and improve the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. We value the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security law. Our cybersecurity risks, and the controls designed to mitigate those risks, are included as a part of our overall risk management governance which is reviewed at least annually by our board of directors.

companyName: CV Sciences, Inc.

ticker: CVSI


text: Our IT networks and related systems are critical to the operations of our business and essential to our ability to successfully perform day-to-day operations. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a component of our internal control system. Cybersecurity awareness, including specific topics related to social engineering and email fraud, are included in our employee handbook. We have processes and controls, in particular with respect to our financial and reporting technology, to prevent and minimize cybersecurity risks and attacks. We rely on industry-standard third-party software and vendors for our core systems, including data storage, analysis and backup.


text: Our board of directors is responsible for overseeing our cyber security risk management and strategy. Our AVP Logistics, Systems & IT is responsible for managing our outside technology services and has over 10 years of relevant experience. The AVP Logistics, Systems & IT reports directly to our Chief Financial Officer and reviews cybersecurity assessments with our Chief Financial Officer on a regular basis. Our Chief Financial Officer is responsible for escalating any cybersecurity matters as appropriate. The Audit Committee of our board of directors will regularly review cybersecurity requirements and risks on a quarterly basis.


text: While we believe we have implemented appropriate measures and controls for our business, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, to our knowledge, there have been no incidents materially affecting the Company, but a material incident could result in disruption of critical IT networks and systems, impeding our operations, release of confidential information, and/or corruption of data. Such an incident could damage our reputation, brands, future sales and could expose us to potential liability.


text: We have an information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We utilize third-party information technology services help identify, measure, and prioritize cybersecurity and technology risks, as well as to develop related security controls and safeguards.

companyName: SeaStar Medical Holding Corp

ticker: ICU


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: DURECT CORP


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • We conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K. Disaster Recovery is tested using various methods such as recovery exercises to simulate a response to a cybersecurity incident, and we use the findings to improve our security, processes, procedures and technologies. • Regular cybersecurity training programs are in place for employees, management and directors. In addition, we conduct annual customer data handling and use requirements training for all employees. • We compare our processes to standards set by the NIST. • Incident handling incorporates the NIST incident handling framework to develop our cybersecurity response procedures and to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident. • We routinely identify and filter out potential threats through threat intelligence processes, attack signatures, and geographic IP filtering. • We closely monitor emerging data protection laws such as GDPR and carefully implement changes to our processes when required for compliance. • We conduct regular phishing email simulations for all employees to enhance awareness and responsiveness to such possible threats. • Through policy, practice and contract (as applicable), we require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care. • We maintain cybersecurity insurance coverage.


text: Our process for identifying and assessing material risks from cybersecurity threats incorporates a risk matrix for identifying risk levels for interconnected systems. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: As part of the above approach and processes, we regularly engage with assessors, consultants and other third-parties to review various parts of our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address oversight and identification of cybersecurity threat risks from our use of third-party service providers, including those in our supply chain. This involves, among other things, conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: In the last two fiscal years, we have experienced no material cybersecurity incidents, and the expenses we have incurred from any cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors (our "Board" or "Board of Directors") and management.


text: The audit committee of our Board (the "Audit Committee") is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, Audit Committee members generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Executive Director of IT. Members of the Audit Committee and the full Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Materials of our cybersecurity threat risk management and strategy processes are also periodically reviewed with the full Board.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Executive Director of IT. This individual has over 25 years of prior work experience in various roles involving: managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and developing and implementing IT change control policies and procedures, as well as holds several relevant degrees and certifications, including a master's degree in Computer Information Systems, Certified in Security+, and has completed extensive cybersecurity training and testing in: Certified Professional Hacker (EMC White Hat Training), ISC2 Certified Information Systems Security Professional (CISSP) Training, and NIST Framework Development and Deployment.


text: Our Executive Director of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: As discussed above, our Executive Director of IT reports to our CEO and informs the members of the Audit Committee and the full Board about cybersecurity threat risks, among other cybersecurity related matters. All executives attend cybersecurity training annually.


companyName: BioAtla, Inc.

ticker: BCAB


text: We maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K • regular cybersecurity training programs for employees and management; and annual cybersecurity management training for employees involved in our systems and processes that handle sensitive data; • leveraging the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • operating threat intelligence processes designed to research our adversaries; • closely monitoring emerging data protection laws and implementing changes to our processes designed to comply; • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice, and contract (as applicable) requiring employees, as well as third-parties who provide services on our behalf, to treat sensitive information with care; • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • maintaining a risk management program for suppliers, vendors, and other third parties, which includes conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed. These approaches vary in maturity across the business, and we work to continually improve them.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigation.


text: As part of the above approach and processes, we have engaged assessors to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We depend on our information technology systems and those of our CROs, manufacturers, contractors and consultants. Our internal computer systems, or those of any of our CROs, manufacturers, other contractors, consultants, existing or future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use or acquisition of or destruction of our proprietary and confidential data, employee data or personal data, which could result in additional costs, loss of revenue significant liabilities, harm to our reputation and material disruption of our operations" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and under the heading "Risks related to employee matters, managing our growth and other risks related to our business."


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Audit Committee semi-annually receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials indicating current and emerging cybersecurity threat risks and describing the company's ability to mitigate those risks. Members of the Board and the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Senior Vice President of IP and Contracts and other members of the management team. Our team has over ten years in information technology, cybersecurity, risk management, and compliance and includes individuals with BS degrees in Information Technology and several information technology and security certifications.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial data, intellectual property, confidential information that is proprietary, strategic, financial or competitive in nature, and personal data.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, for example, periodic cybersecurity testing and cybersecurity awareness training for employees.