text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the UK governments' National Cyber Security Centre. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: Bio Green Med Solution, Inc.

ticker: BGMS

secItem: Item 1C


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: leverage the National Cyber Security Centre incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our response to an incident involves the coordination of activities to detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including having a third-party independent qualified and accredited advisor review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we would require those third parties, although there are currently none, that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor heading " Security incidents, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability " which disclosures are incorporated by reference herein. We have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes. In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experienced any cyber security incident.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer. Our Chief Financial Officer has been responsible for our IT functions for 20 years and has managed the IT function of companies generally for the last 35 years. The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, periodically.


text: Our third party Information and Technology service providers manages the Company's security program, which is focused on assessing, identifying, and managing cyber risk and information security threats. Our management team, including our Chief Executive Officer and Chief Financial Officer, evaluates cybersecurity on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and board of directors, described below under "Governance."

companyName: Vyome Holdings, Inc

ticker: HIND


text: To proactively manage cybersecurity risk in our organization, our management team has instituted a security policy that is available to all employees.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Technology providers identifies and addresses known cybersecurity risks on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process. We are not aware of any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition as of the date of this Annual Report on Form 10-K.


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Executive Officer or Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings.


text: The Company has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into its overall risk management systems and processes. The Company routinely assesses material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through its information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: The Company conducts periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: One of the key functions of the Board is informed oversight of the risk management process, including risks from cybersecurity threats. The Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect it or its business strategy, results of operations, or financial condition. For more information regarding the expertise of the Board as it relates to cybersecurity, see the section entitled "Governance" in the Company's definitive proxy statement relating to the 2024 Annual Meeting of Stockholders filed with the SEC on April 29, 2024.


text: Gold Resource Corporation Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare the Company to address cybersecurity risks. As part of the overall risk management system, the Company monitors and tests safeguards and trains employees on these safeguards. Personnel at all levels and departments are made aware of the cybersecurity policies through trainings.


text: As of December 31, 2024, the Company has not identified an indication of a cybersecurity incident that would have a material impact on the Company's business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: Glen Burnie Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Senior Vice President, Director of Information Technology. In addition, the Internal Auditor, Information Security Officer, and Compliance Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: The Senior Vice President of Information Technology ("IT") works with the Managed Service Provider (MSP) information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, standards, and architecture processes. The Director of IT is responsible for the IT-related security policies. The Director of IT, in coordination with compliance, the information security officer, and human resources, conducts at least annual and ongoing company-wide information security awareness training. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the Director of IT, vendor management team and the business department head assessing cybersecurity robustness during vendor review before onboarding, the inclusion of protective provisions in vendor agreements, and risk-based monitoring of vendors on an ongoing basis.


text: The Board of Directors receives regular reports from the Senior Vice President, Director of IT and the Information Security Officer on Glen Burnie Bancorp's cyber risks and threats, the status of projects to strengthen Glen Burnie Bancorp's information security systems, assessments of Glen Burnie Bancorp's security program, and the emerging threat landscape. Additionally, the Information Technology Committee drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. Glen Burnie Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Information Technology Committees of the Board. The Company also engages with key vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Information Technology Committee and Board of Directors.


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors (the "Board"), primarily through its audit committee of the Board (the "Audit Committee"). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report on Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors, "We are reliant on information technology systems and may be subject to damaging cyber-attacks or security breaches" and "We are subject to data privacy laws, rules and regulations and any non-compliance with such laws, rules and regulations, could adversely affect our business, financial condition and operating results" in this Annual Report on Form 10-K.


text: Board of Directors The Audit Committee oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Company's Head of Information Technology ("Head of IT") provides reports on cybersecurity matters, including material risks and threats, annually or more frequently as appropriate to the Board, including to the Audit Committee.


text: Under the oversight of the Audit Committee, and as directed by the Head of IT, Company management is primarily responsible for the assessment and management of material cybersecurity risks.


text: The Head of IT brings over a decade of extensive experience in global technology organizations spanning various industries. With a background encompassing more than a decade of expertise in information security, risk management, and compliance, The Head of IT has successfully led cyber security initiatives and ensured compliance with regulatory standards such as the Health Insurance Portability and Accountability Act and The Telephone Consumer Protection Act. The Head of IT is also supported by an Incident Response Team Security Officer ("IRT Security Officer") who provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents. The Company's IRT Security Officer has completed rigorous cybersecurity awareness and threat response training and has the skills to develop effective incident response plans and swiftly mitigate emerging cyber threats. The IRT Security Officer enhances the Company's cybersecurity posture and readiness with expertise in threat detection, incident coordination, and remediation.


text: All dollar amounts expressed in thousands, except per share amounts The Head of IT oversees the Company's cybersecurity incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The Head of IT also coordinates with the Company's General Counsel and interim Chief Financial Officer (the "Interim CFO") to assess and manage material risks from cybersecurity threats. The Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.


text: The Company's Disclosure Committee, with the assistance of its Cybersecurity Subcommittee, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Interim CFO, General Counsel, Vice President of Investor Relations and Communications, Corporate Controller, and Financial Reporting Manager. The Cybersecurity Subcommittee of the Company's Disclosure Committee is comprised of, among others, the Company's Interim CFO, Head of IT, General Counsel, Corporate Controller, and IRT Security Officer.


text: The Head of IT, or a delegate, informs the Cybersecurity Subcommittee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes. The Cybersecurity Subcommittee is also primarily responsible for advising the Disclosure Committee and the Company's CEO and Interim CFO regarding cybersecurity disclosures in public filings. The Head of IT, with the General Counsel in attendance, also notifies the Audit Committee chair of any material cybersecurity incidents.


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues which may arise in the most timely and aggressive fashion.

companyName: UR-ENERGY INC

ticker: URG


text: As potential new threats to security are identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our IT Manager and expert consultants who report to our Chief Financial Officer. Our Chief Financial Officer has relevant expertise gained from nearly 20 years' experience overseeing our information technology matters, including cybersecurity concerns. With respect to cybersecurity, our consultants support our risk assessment and scoring, securing devices and networks, vulnerability management, proactive monitoring, responding to cyber threats and more. They act as our security operations center, as well as a seamless extension of our IT department.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and HSE & Technical Committee of the Board each having certain responsibilities relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirements. In addition to its other responsibilities, the HSE & Technical Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.


text: Members of our Board each have a practical understanding of information systems, and the technology used in our business operations, as well as a recognition of the risk management aspect of cyber risks and cybersecurity; members of the Board are encouraged to review materials on these issues or attend informational sessions. The HSE & Technical Committee and/or the full Board receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. Management and our Board recognize that this is an evolving environment and therefore our analyses of the risks and risk management are also evolving. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," above.


text: We understand the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Certain cybersecurity processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated into our operations as a part of our overall risk assessment process.

companyName: Transcode Therapeutics, Inc.

ticker: RNAZ


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party computer support firm to assist with network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.


text: Since July 2021, we have no knowledge of any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our third-party CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our current or future therapeutic candidates' development programs," and "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," for additional discussion about cybersecurity-related risks.


text: Cybersecurity is an important part of our risk management processes. Our Chief Financial Officer is the primary person in our company responsible for overseeing the cybersecurity risk management program. He has had oversight of our cybersecurity and risk management programs since the second half of 2021. This is not a full-time function for our Chief Financial Officer and because he is not an experienced computer professional, he relies to a large degree on our outside information technology, or IT, support firm. He is also immediately alerted of any cybersecurity breaches that occurs by our third-party vendors or by others so that appropriate measures may be taken timely.


text: Our Board of Director's role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks. The Board conducts its risk oversight by receiving reports from our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats.


text: Cybersecurity is an important component of our overall approach to risk management. We have implemented cybersecurity processes, technologies and controls to facilitate our efforts to identify, assess and manage material risks from cybersecurity threats. We leverage industry associations, third-party benchmarking, results from internal and third-party testing, and other similar resources to inform our cybersecurity programs and processes. We also adhere to applicable Payment Card Industry Data Security Standards. We have prioritized improving our cyber security posture to safeguard our systems and mitigate risks.

companyName: Citi Trends Inc

ticker: CTRN


text: Our cybersecurity programs include physical, administrative and technical safeguards designed to help us detect and prevent cybersecurity threats and incidents. We monitor our cybersecurity programs and processes through assessments focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. In addition, we have engaged third parties to perform reviews of our information security control environment, and to provide expertise on various cybersecurity programs and issues. Our cybersecurity team has established a written incident response plan in the event of an incident. We do not retain any sensitive customer data on our systems.


text: We provide routine awareness training for associates regarding cybersecurity best practices and their role in protecting the Company from cybersecurity attacks and testing to measure the effectiveness of our information security program.


text: We have not experienced any material cybersecurity incidents in fiscal 2024, and as of the date of this Report, we have not identified any material risks from active cybersecurity threats, including as a result of any prior cybersecurity incidents. However, despite our security measures, there can be no assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain insurance to mitigate potential losses from a cybersecurity incident, such insurance may be insufficient to cover all losses or all types of claims that may arise. See Item 1A. Risk Factors in this Report for a discussion of whether and how risks from identified cybersecurity threats have materially affected or, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Management is responsible for implementing our cybersecurity program on an ongoing basis to identify, assess and manage cybersecurity risks. Our cybersecurity program is led by our Vice President of Information Systems with support from our Senior Manager of IT Security & Compliance and various other team members. Our Vice President of Information Systems has over 25 years of industry experience, including more than 10 years as the leader of the Company's technology function. On a bi-annual basis, or more frequently as needed, management informs the audit committee of material aspects of our cybersecurity program, including updates on key strategic and operational goals, assessments of cybersecurity risks, updates to any incidents, and the status of our ongoing investments in cybersecurity governance.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. Our audit committee oversees management's policies, programs and procedures related to cybersecurity risk management and reports to the board regarding these efforts. In addition, the audit committee receives briefings from management bi-annually, or more frequently as needed, on material aspects of our cybersecurity program.


text: Mesabi Trust does not have any directors, officers or employees. The Corporate Trustee is responsible for oversight of Mesabi Trust's risks from cybersecurity threats as it relates to financial record keeping, cash and investment management, administration and reporting. The Corporate Trustee also serves as registrar and transfer agent for the Trust. The Corporate Trustee has dedicated personnel responsible for assessing and managing Mesabi Trust's cyber risk management efforts, informing senior management of the Corporate Trustee regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts. The Corporate Trustee's information technology team has significant experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Corporate Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Corporate Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Corporate Trustee. The Corporate Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Corporate Trustee's overall risk management process. The Corporate Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions, computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Corporate Trustee has an annual assessment, performed by a third-party vendor, of the Corporate Trustee's cyber risk management program. Other non-technical protocols include securing of documents and work areas that could contain non-public information and independent verification of information changes by outside vendors. Mesabi Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, results of operations, cash flows or reputation. The Corporate Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Mesabi Trust's focus, financial condition, results of operations, or cash flows. See "Risk Factors – General Risk Factors – The Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, financial record keeping, investment management, reporting, results of operations, cash flows or reputation."

companyName: MESABI TRUST

ticker: MSB


text: We have developed and implemented a cybersecurity risk management policy intended to protect the confidentiality, integrity and availability of our critical systems and information. Our policy establishes the framework for managing cybersecurity risks and outlines the measures and protocols to protect our information systems. Our risk management and strategy is managed by our third-party IT Management Service Provider, Network Center, Inc. ("Network Center") with oversight by our VP of Operations. Our policy applies to all employees, contractors, and all third-party partners who have access to our information systems. Our cybersecurity risk management policy is integrated into our overall enterprise risk management processes.

companyName: Lodging Fund REIT III, Inc.


text: Our risk management policy includes continual monitoring by Network Center, as they manage our technical defenses. Risk assessments and penetration testing are performed on a quarterly basis to identify and mitigate potential threats. Procedures have been implemented for identifying, evaluating and addressing vulnerabilities. Additionally, vulnerability assessments are performed monthly by Network Center. An additional part of our risk management strategy is having a clear process for reporting cybersecurity incidents and the development and maintenance of an incident response plan to address and mitigate the impact of cybersecurity incidents.


text: A key component of our risk management and strategy surrounds data protection. We have implemented strict access controls for each individual employee to ensure only authorized personnel can access sensitive and confidential data. All digital communication is pre-screened for potentially malicious actions through a dedicated email security provider. For additional protection, we have implemented multi-factor authentication along with email encryption to ensure data is protected while at rest and in transit. We are also protected through a multilayered approach to security through the ESET Protection Platform, which provides formidable defense through cyber threat prevention, detection and response.


text: In addition, we provide regular cybersecurity training to all employees on a quarterly basis and conduct ongoing awareness programs to keep employees informed about cybersecurity best practices. Employees have been trained, enabling them to detect and report on any malicious intrusions or social engineering attempts to infiltrate our systems. They are also regularly trained, tested and reported on through KnowB4 spear-phishing email campaigns to ensure our training is effective. We are fully insured for cyber risk through our insurance provider.


text: Our board of directors is responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On an annual basis, management receives a report from Operations Management on our cybersecurity threat risk, management processes, and strategies. In addition to annual meetings, our board of directors, management and Audit Committee are notified of any cybersecurity incident, its threat level and the response. The threat level and response are evaluated and documented in a report by Operations leadership and our IT Services Provider. Based on our board of directors and Audit Committee review of the incident report, they determine if the findings require disclosure to the SEC.


text: Our cyber security policies and procedures are reviewed and updated annually or as needed to address any emerging threats and changes in regulatory requirements.


text: To date, there have been no confirmed cyber security breaches, unauthorized intrusions or threats detected within our mainframe operating systems, our encrypted e-mail servers, or our advanced firewall protections, and we have not identified risks from known cybersecurity threats, that have materially affected or that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors – We and our hotel managers and franchisors rely on information technology in our operations, and any material failure, inadequacy, interruption, cyber-attack or security failure of that technology could harm our business."


text: The Bank's information security program is designed to protect sensitive, confidential, and non-public personal information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public personal information, financial data, and internal operational information. Our Chief Information Officer ("CIO") manages our information security strategy and development as overseen by our overarching Enterprise Risk Management ("ERM") program.

companyName: Primis Financial Corp.

ticker: FRST


text: The Bank's cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products, and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.


text: The Bank's Network Team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats. The Network Team also actively monitors the Bank's networks and systems to detect suspicious or malicious events, and contracts with third-party consultants to perform penetration testing and routine vulnerability scans. A third-party managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.


text: We maintain policies and procedures for the safe storage, handling, and secure disposal of customer and employee information. Each employee is expected to be responsible for the security and confidentiality of customer information, and we communicate this responsibility to employees upon hiring and regularly throughout their employment. Annually, we provide employees with mandatory security awareness training. The curriculum includes the recognition and appropriate handling of potential phishing emails, which could place sensitive customer or employee information at risk. We employ a number of technical controls to mitigate the risk of phishing emails targeting employees.


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CIO who closely coordinates with the Bank's Information Technology team. The Incident Response Plan describes the Bank's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Bank's Executive Management, including the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Risk Officer ("CRO"), and the Board of Directors. We regularly test the Incident Response Plan, including through tabletop exercises, and document lessons learned. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents.


text: The Bank conducts due diligence prior to engaging third-party service providers which have access to the Bank's networks, systems, and/or customer or employee data. Risk assessments are performed using Service Organization Controls (SOC) reports, self-attestation questionnaires, and other tools. Third-party service providers are required to comply with the Bank's policies regarding non-public personal information and information security. Third parties processing non-public personal information are contractually required to meet legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract execution, Primis conducts ongoing monitor of third-party service providers/vendors on a risk-based approach.


text: We continue to optimize our business continuity and disaster recovery plans aligned to the pervasive nature of cybersecurity incidents and threats. We also increased our cyber insurance which aligned to strengthen our internal systems. While the Bank has encountered, and will continue to encounter, cyber incidents in the normal course of business, to date, the Bank has not experienced a cybersecurity incident that has materially impacted our business strategy, financial condition, or results of operation. Despite our ongoing efforts to continually strengthen our cybersecurity program, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in safeguarding our systems and information. We face risks from certain cybersecurity threats that, if realized, could reasonably be expected to materially affect our business strategy, financial condition, or results of operation. See "Item 1A. Risk Factors – Operational Risks" in this 10-K for additional information.


text: Our Board of Directors is responsible for overseeing the Bank's business and affairs, including risks associated with cybersecurity threats. The ERM Committee ("ERMC") of the Board has primary responsibility for overseeing the Bank's comprehensive ERM program, including its cybersecurity program. The ERM program assists the Executive Management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both Audit Committee ("AC") and ERMC meetings.


text: The Board's oversight of cybersecurity risk is supported by our CIO. The CIO attends ERMC meetings and provides cybersecurity updates to these Board committees on a quarterly basis. Our CRO, in conjunction with our CIO, facilitates the involvement of the ERMC in oversight of potentially significant cybersecurity incidents.


text: The Bank's CIO directs the Bank's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CIO manages the Bank's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CIO is also responsible for the Bank's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. Led by our CIO, the Network Team examines risks to the Bank's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats. Our CIO has worked in the financial services industry for over 20 years and held similar roles at other financial institutions including four years as a Chief Information Officer. Our CRO has over three decades of experience in risk management, and our Network Team collectively has over 19 years of experience in cybersecurity operations.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our policies over areas such as information security, access on/offboarding, and access and account management help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Scorpius Holdings' management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of our corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows and/or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We believe cybersecurity is of critical importance to our success. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries, as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action. Accordingly, we are committed to maintaining robust cybersecurity and data protection and continuously evaluate the impact of cybersecurity threats, considering both immediate and potential long-term effects of these threats on our business strategy, operations, and financial condition.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: The Audit Committee, under oversight of the Board of Directors, has responsibility for oversight of risks from cybersecurity threats, and the assessment and management of cybersecurity risks is the responsibility of the Information Security ("INFOSEC") team. The INFOSEC team is managed by the Vice President, Information Technology, who reports to our Chief Financial Officer. Our current Vice President, Information Technology and other members of our INFOSEC team collectively have more than 60 years of experience in information technology and extensive education and industry experience managing cybersecurity risks, developing and implementing cybersecurity policies, and responding to cybersecurity incidents.


text: Under the oversight of the Audit Committee, our management and the INFOSEC team have established comprehensive processes for identifying, assessing and managing material risks from cybersecurity threats, and these processes are integrated into our overall enterprise risk management program. Our approach is proactive and adaptive, featuring regular security assessments, third-party audits, team member training, and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry best practices and regulatory standards. We continually evaluate our information technology systems to identify new and monitor existing cybersecurity risks based on observed activity on the systems. We evaluate the nature and severity of identified risks, and whether changes to the system are necessary. We perform annual cybersecurity training for all employees with access to our systems and conduct regular test phishing campaigns. We engage a third-party to assist in monitoring, preventing and detecting potential cybersecurity vulnerabilities and incidents, including performing scans of our information technology systems and penetration testing. We use the results of the various tests to inform our response plan, update our systems, and train employees.


text: Upon the identification of a cybersecurity incident, the Incident Response Team ("IRT") initiates our Security Incident Response Policy. This includes determining the scope and risk level of the incident, the incident response, and the steps necessary to reduce the likelihood of reoccurrence. Depending on the severity of the incident, the IRT reports the incident to the Audit Committee, as well as communicates with other appropriate stakeholders. In addition, a summary of cybersecurity incidents, results of testing, corporate security training and planned enhancements are reported to the Audit Committee at least quarterly by the Vice President, Information Technology.


text: Our third-party business partners also play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party business partner risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new third-party business partners and maintain ongoing evaluations to ensure compliance with our security standards.


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, nor are we aware of any cybersecurity risks that are reasonably likely to have, a material adverse impact our business strategy, results of operations, or financial condition. Notwithstanding the extensive approach that we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion of the risks we face from cybersecurity threats, see risk factor titled "Our management information systems and databases could be disrupted by system security failures, cyber threats or by the failure of, or lack of access to, our Enterprise Resource Planning system. These disruptions could negatively impact our sales, increase our expenses, subject us to liability and/or harm our reputation." in Item 1A. "Risk Factors."


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes, which we rely on information technology systems and networks managed and maintained by independent third parties. Our information technology personnel, responsible for cyber security, monitors daily and weekly backups of our system to protect against data loss and minimize disruption to our operations in the event of a cybersecurity incident. Our data is accessible by our assigned personnel and third parties as necessary and appropriate, to perform services or otherwise do business with us, and we have implemented two-factor identification for access to our third party systems to submit relevant data to our IND.

companyName: BURZYNSKI RESEARCH INSTITUTE INC

ticker: BZYR


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our information technology personnel and our senior management lead the operational oversight of the company -wide cybersecurity strategy and processes. The board of directors provides oversight of our cybersecurity risk. Additionally, the board of directors reviews our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: XCel Brands, Inc.

ticker: XELB


text: The program is managed by our executive management team, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with and rely upon outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity risks.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board of Directors receives periodic updates on cybersecurity and information technology matters and related risk exposures from management.


text: We recognize the critical importance of cybersecurity in upholding the safety and security of our systems, services and data and maintaining the trust of our customers. Cybersecurity risk management is an important part of, and is integrated into, the Company's overall enterprise risk management program. We maintain a cybersecurity risk management program that is designed to identify, assess, manage and mitigate cybersecurity risks and provides a framework for responding to cybersecurity threats and incidents. We regularly assess and update our cybersecurity risk management program and our cybersecurity posture to protect the confidentiality, integrity and availability of the Company's and our customers' infrastructure, resources and information.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: We designed a multi-faceted risk-management approach based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and informed by other industry standards and industry-recognized practices to identify and address cybersecurity risks. Our key cybersecurity processes include the following:


text: Risk-based, layered controls – We regularly assess and adjust our technical controls and methods to identify, respond to and mitigate emerging cybersecurity risks and use a layered approach with overlapping controls to defend against cybersecurity attacks and threats to our networks, end-user devices, infrastructure, applications, data and cloud solutions and the data that our customers entrust to us.


text: Cybersecurity incident response plan and testing – We have a global incident response process and dedicated teams responsible for monitoring, detecting and responding to cybersecurity threats and attacks, whether external or internal, periodically testing our processes and protocols, and regularly communicating and providing reports to our CISO, Security & Resiliency global practice leader and senior executive leadership.


text: Information sharing and collaboration – We utilize threat intelligence and security information collected from various sources, including but not limited to partners, suppliers, governments and information sharing and analysis centers, to identify, protect against, detect and respond to potential cybersecurity threats and events.


text: We use a combination of training and education, including mandatory annual cybersecurity and privacy training, phishing simulation exercises and a multitude of alerts, educational tools, videos and other ongoing awareness initiatives on a variety of topics relating to the rapidly evolving threat landscape, throughout the year that foster a culture of security awareness and responsibility among our workforce.


text: Supplier risk assessments – Recognizing that our suppliers can be subject to cybersecurity incidents which may impact us and our customers, our procurement process includes security, data governance and privacy risk assessments to identify and evaluate risk associated with certain key suppliers, including reviewing relevant cybersecurity certifications and third-party audit results, assessing technical and organizational controls and evaluating their risk profile.


text: We periodically engage third-party security consultants to conduct evaluations of our cybersecurity controls and procedures, including penetration testing, third-party audits, and reassessing best practices to address new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls and procedures. Our internal audit function conducts additional reviews and assessments of our cybersecurity controls and procedures and reports to the Audit Committee and the Board of Directors as appropriate. We use the findings from these efforts to improve our practices, procedures and technologies.


text: Cybersecurity Risk Oversight and Governance Our Board of Directors is responsible for the overall oversight of our enterprise risk management. The Audit Committee periodically reviews the Company's enterprise risk management framework, including enterprise risk management processes, and assists the Board of Directors in its oversight over certain key areas of risks, including overseeing cybersecurity, data governance and privacy risk and regularly reporting on such matters to the Board. The Audit Committee and full Board of Directors receive periodic updates from our CISO about Kyndryl's cybersecurity policies and practices, cybersecurity developments, trends, risks, notable incidents, mitigation strategies, maturity initiatives and other developments throughout the year, as well as periodic updates from our CIO, Security & Resiliency global practice leader and other senior leaders on cybersecurity-related matters.


text: Our information security program is led by our CISO, who is responsible for the overall security of the enterprise, and our Security & Resiliency global practice leader, who is responsible for the security of the services that we provide to customers. Our CISO and Security & Resiliency global practice leader collaborate closely with one another and other key stakeholders across the Company in developing and implementing our cybersecurity strategy, policy, controls, operations, threat detection and incident response and remediation. Our teams that support the CISO and Security & Resiliency global practice leader in these efforts are comprised of cybersecurity professionals with many years of experience in cybersecurity across multiple sectors, including heavily regulated industries such as financial services and defense, and many of them hold relevant industry certifications.


text: Under our global incident response process, cybersecurity incidents are assessed and classified by severity, and significant incidents are escalated as appropriate to senior executive leadership. In addition, we have a process to promptly notify the Board of Directors, as appropriate, in the event of any cybersecurity incident impacting the Company that may be material.


text: Based on the information we have as of the date of this Form 10-K, we do not believe that any cybersecurity incident experienced by the Company has materially affected or is reasonably likely to materially affect Kyndryl, including our business strategy, results of operations or financial condition. For additional information about cybersecurity risks, s ee Item 1A. "Risk Factors."


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal operational risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage such material risks.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: To aide in identifying and assessing material risks from cybersecurity threats, our Enterprise Risk Management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring and vulnerability assessments to inform our professionals' risk identification and assessment.


text: We manage these known risks by using internal security controls designed to align with standards set the International Organization for Standardization ("ISO"). In connection with the identification, assessment and management of material risks and cybersecurity threats, we also conduct the following activities at various intervals during the year: monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply with such laws; undertake regular reviews of our customer facing policies and statements related to cybersecurity;


text: run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team;


text: conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations; and carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.


text: Our cybersecurity incident response plan was developed to respond to the threat of security breaches, the threat of cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate material cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident.


text: We regularly engage with auditors to review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: In our risk factors, we describe how potential risks from cybersecurity threats may affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board has oversight responsibility for the Company's Enterprise Risk Management framework. The Board as a whole and through the various Board committees oversees the Company's management of material enterprise level risk, focusing on four areas of risk: strategic, compliance, operational, and financial. To fulfill its oversight responsibility, the Board also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. Board members, including members of the Audit Committee, have expertise and/or operational experience in cybersecurity matters. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.


text: As part of our entire Board's operational risk management responsibilities, it has oversight of risks from cybersecurity threats. The Audit Committee has been designated with the responsibility to regularly review the Company's processes and procedures around managing cybersecurity threat risks and cybersecurity incidents. As discussed below, members of management report to the Audit Committee which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: In support of the Board's oversight of the Company's cybersecurity risk management program, the Audit Committee receives quarterly cybersecurity updates from members of management. These updates include topics, such as threat risk management updates, the results of exercises and response readiness assessments, our incident response plan, and steps management has taken to respond to such threat risks, if any.


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: We face various cybersecurity threats as a prominent target, including denial-of-service attacks, ransomware, phishing, and advanced persistent threats. As an aerospace and defense company providing advanced defense technologies and services to the U.S. and foreign governments, these threats are not just from low-level threat actors, but rise to the level of sophisticated threat actors from organized and funded adversaries, including groups affiliated with various nation states. Our customers, suppliers, subcontractors, and vendors also face similar threats. Cybersecurity incidents impacting us, or any of these third parties, could have a material adverse effect on our operations, financial condition, and results of operations. Given the cybersecurity risks we face, we dedicate ample resources to addressing and mitigating our cyber risks.

companyName: AeroVironment Inc

ticker: AVAV


text: Our cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber risks and incidents. Our cybersecurity program is part of our internal risk management processes, and we continually improve our cybersecurity practices as new threats and vulnerabilities emerge.


text: Our Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), and Vice President of Cybersecurity, all within our "CIO organization," lead our Detection and Response Team ("DART") which is responsible for our cybersecurity incident response processes pursuant to our Incident Response Plan and playbooks. The DART also includes members of our IT department responsible for supporting the technologies and processes to protect against, detect, contain, mitigate, and recover from cybersecurity incidents. The DART evaluates and assigns severity levels to cybersecurity incidents and, based on the severity, escalates and engages incident response teams to respond to and mitigate the risks.


text: Our cybersecurity team proactively hunts for cyber threats and vulnerabilities in our networks and information systems as part of our cyber risk management program. This includes monitoring our networks and systems for indicators of compromise ("IOCs"), active intrusion attempts, and other suspicious activity, including insider threat risks. The cybersecurity team stays apprised of existing and emerging cybersecurity threats through commercial threat intelligence feeds and by partnering and data sharing with third parties such as the U.S. government, law enforcement agencies, customers, and other Defense Industrial Base ("DIB") participants. We also engage third parties to conduct evaluations of our cybersecurity controls by performing penetration testing and controlled cybersecurity framework audits. We also review the cybersecurity practices of our third-party service providers and suppliers.


text: We require our employees to take cybersecurity-related training regularly to promote awareness of how to detect, report, and respond to cybersecurity threats. Employees with certain roles and responsibilities are also assigned cyber training for their specific functions. We also maintain an Insider Threat program, headed by our Director of Security, to identify, assess, and deal with potential risks from within our company, including cybersecurity risks.


text: We have aligned our cybersecurity program to the National Institute of Standards and Technology's ("NIST") published cybersecurity standards, and our policies and processes are compliant with NIST Special Publication 800-171 and other applicable publications. Given our status as a defense contractor, we are subject to numerous regulations, including those pursuant to the Defense Federal Acquisition Regulation Supplement ("DFARS"), requiring us to have controls in place to protect U.S. government CUI and to report cybersecurity incidents to the DoD.


text: We are also subject to the DoD CMMC requirements which necessitates that companies receiving, storing, or processing federal contract information ("FCI") and CUI be formally assessed by a CMMC C3PAO. AeroVironment, Inc., including its subsidiaries Arcturus UAS and Tomahawk Robotics (but excluding any of the BlueHalo acquired entities) is scheduled for a formal Level 2 assessment. The recently acquired BlueHalo passed a formal CMMC Level 2 assessment under the CMMC 2.0 framework, which went into effect December 16, 2024. If we fail to achieve or maintain certification ahead of contract awards, or if we fail to achieve the level required for a particular contract, we will be unable to bid on new contracts or follow-on efforts containing CMMC clauses, which could adversely impact the success of our operations. Additionally, our subcontractors and certain vendors may need to obtain CMMC certification, and we may be negatively impacted if they are not compliant with the CMMC requirements.


text: Our CIO, CISO, and VP of Cybersecurity, each with 20+ years of related experience, are responsible for the day-to-day management of our cybersecurity program and cybersecurity risks. Our CISO and team are primarily responsible for our overall cybersecurity risk management program and supervise both internal and external resources to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and incidents.


text: We have internal Cybersecurity Council which meets monthly to help communicate our enterprise cybersecurity strategy and ensure it is implemented across the business, as well as maintain awareness of events and changes occurring throughout the business. The Cybersecurity Council consists of members from our CIO organization as well as senior leadership from various functional areas of the business.


text: The CISO and VP of Cybersecurity report cybersecurity incidents to members of the company's senior management, including the Cybersecurity Council, CIO, CEO, and the Board of Directors based on the severity and type of the incident to ensure proper external reporting is completed thoroughly and timely. Pursuant to its charter, the Cybersecurity Committee of our Board of Directors is responsible for reviewing, discussing, and making recommendations to the full board regarding cybersecurity matters. Our CIO, CISO, and VP of Cybersecurity provide presentations to the Cybersecurity Committee on our cybersecurity program at each of the committee's regularly scheduled quarterly meetings. These briefings include assessments of the cyber risk and threats landscape, updates on incidents, policies and procedures, and our investments and plans in cybersecurity risk mitigation and governance. The Cybersecurity Committee also meets with members of the Cybersecurity Council to discuss various aspects of our cybersecurity program between regular meetings. All members of the Board of Directors are invited to attend all meetings of the Cybersecurity Committee, and the committee regularly briefs the entire board regarding their oversight of our cybersecurity program.


text: We have experienced cybersecurity incidents in the past and will experience cybersecurity incidents in the future. Prior cybersecurity incidents have not materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition; however, there is no guarantee that a future cybersecurity incident would not have a material adverse effect on such items. While our cybersecurity program is designed to mitigate cybersecurity risks, we cannot eliminate all risks from cybersecurity threats. See Item 1A. Risk Factors for more information on our cybersecurity risks.


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and business operations, including vetting and managing third-party service providers with comprehensive due diligence, continuous monitoring and strict compliance with industry standards. In addition, we provide cybersecurity awareness training to our employees, incident response personnel, and senior management, including training on best practices for data privacy and security. Our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.

companyName: Capstone Green Energy Holdings, Inc.

ticker: CGEH


text: The Board is responsible for overseeing assessments of major risks facing the Company and for reviewing options to mitigate these risks. It has delegated oversight responsibility for information security matters to the Audit Committee, Chief Financial Officer ("CFO") and our internal information technology ("IT") resources. Our Director of IT manages our internal team of security professionals, as well as our third-party IT service providers, which provides 24/7 security monitoring. The personnel comprising our IT team include a certified information system security professional and other professionals with many years of experience across a variety of technological sub-specialties.


text: Our CFO oversees our cybersecurity risk management, including appropriate risk mitigation strategies, systems, processes, and controls, and receives updates from IT and our third-party IT service providers on cybersecurity and information security matters. The CFO communicates with the Audit Committee and the Board periodically regarding the state of our cybersecurity risk management, current and evolving threats and recommendations for changes. We have also implemented a cyber incident response plan that provides a protocol to report certain incidents to the CFO with the goal of timely assessment of such incidents, determining applicable disclosure requirements and communicating with the Audit Committee and the Board for timely and accurate reporting of any material cybersecurity incident. The incident response plan is reviewed and tested in the annual cybersecurity desktop exercise.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For additional discussion of our cybersecurity-related risks, see Part I, Item 1A, "Risk Factors."


text: Risk Management and Strategy Assessing, Identifying and Managing Material Risks Our cybersecurity program is focused on assessing, identifying, and managing risks arising out of our use of information technology including the risk of cybersecurity incidents and threats. Our program is informed by recognized frameworks (such as the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework) and leverages external and internal expertise, as appropriate. Our program is integrated into our operations and is widely communicated to employees through annual employee and contractor cybersecurity awareness training, regular awareness exercises, and employee outreach activities including cybersecurity tech talks, on-site digital signage, intranet resources, CEO cybersecurity champion recognition at quarterly town hall meetings, and other targeted communications. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment, investigation, and remediation by our internal cybersecurity team.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Integration with Enterprise Risk Management The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with our Senior Vice President & Chief Information Officer serving on our ERM Committee and our Vice President of ERM serving as the strategic crisis management coordinator under our cybersecurity incident response plan. We have developed processes for managing cybersecurity incidents including clear allocation of responsibilities and defined incident classifications, escalation requirements based on materiality, and prioritization parameters. Our cybersecurity incident response plan is integrated into our ERM Committee risk mitigation action plan process, our Senior Leadership Team (SLT) strategic crisis management action plan process, and our Disclosure Committee protocol for cybersecurity incidents. We also maintain business continuity and disaster recovery plans to prepare for potential information technology disruptions.


text: Cybersecurity Program Components Our cybersecurity program structure consists of our cybersecurity operations center; identity and access management; governance, risk, and compliance; architecture; and operational technology. Aspects of our program include:


text: Activities to assess vulnerabilities including penetration testing, red teaming, tabletop exercises, and phishing and social engineering drills Engagement with law enforcement and U.S. government agencies, directly and through memberships in various cybersecurity intelligence and risk sharing organizations to help us stay informed about evolving threats Utilization of third-party experts to test, validate, and strengthen our plans, practices, and policies Technology team collaboration sessions to share information across different teams, geographic areas, and areas of responsibilities Assessing and managing cybersecurity risks arising out of the use of third-party technology and services, including pre-contract diligence, imposition of contractual obligations, and performance monitoring Learnings from these activities are used to inform our training, guide our incident response preparedness and enhance our plans and processes. To further inform our cybersecurity program, we also participate in discussions with third-party service providers who have experienced cybersecurity incidents.


text: Investment in Cybersecurity Program The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in several key areas including investing in our employees through talent recruitment, retention, training and development, investing in external resources including procuring and deploying the correct tools to monitor, evaluate, and address threats, investing employee resources to maintain effective processes, and investing in strategic relationships to monitor evolving risks including third-party service provider vulnerabilities. While our third-party service providers have experienced cybersecurity incidents and we have experienced threats to our data and systems, to date, we are not aware that we have experienced a breach that had a material impact on our operations or business, however, cybersecurity risks that may materially impact the Company are discussed in more detail in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity and Information Technology Risks," which should be read in conjunction with the foregoing information.


text: Our management is responsible for identifying, assessing, and managing our exposure to cybersecurity risk. Management identifies and assesses risks through its cross functional ERM committee that is responsible for: Facilitating risk conversations with cross-functional leaders and teams


text: Partnering with risk owners to develop risk management action plans focused on mitigating the drivers of the enterprise risks Identifying key metrics to objectively assess the risk to the Company applying both a short-term and long-term perspective Informing our strategic planning based on risks assessments after consideration of action plans and residual risk Developing a risk-aware culture throughout the organization Our Board of Directors and its Audit / Finance Committee play an active part in overseeing cybersecurity risks relevant to the Company. The Board and its Audit / Finance Committee routinely receive reports from our management and external advisors on critical risk areas.


text: The Company maintains a dedicated internal cybersecurity team that is supported by internal and external software, third-party experts, and threat intelligence resources. Members of our cybersecurity team provide cybersecurity reports to our Board, SLT, and cross-functional leaders and teams. The internal cybersecurity team is responsible for implementing our cybersecurity strategy including policies, standards, architecture, and processes including our processes for identifying cybersecurity risks and threats and recommending mitigating actions to strengthen cybersecurity resilience. In addition, our internal cybersecurity team is responsible for managing detection, mitigation, and remediation of all cybersecurity incidents.


text: Conagra's Cybersecurity Team is led by our Chief Information Security Officer (CISO). Our CISO, a certified information security professional, has more than 25 years of cybersecurity leadership experience across multiple industries and holds a Doctor of Science (DSc) degree in Cybersecurity. The CISO reports to our Chief Information Officer (CIO), who has been with Conagra for more than 20 years serving in various leadership roles in information technology, finance, and business services. We believe our CIO possesses a firm understanding of the Company's cybersecurity landscape, risks, and knowledge of the capabilities of our cybersecurity and information systems personnel.


text: Additionally, members of our internal cybersecurity team have experience in cybersecurity risk management, threat monitoring, threat emulation, penetration testing, cyber incident response management, and data protection. Team members have both individual responsibilities and a team focus, and manage both internal and third-party cybersecurity risk mitigation, covering areas such as network, endpoint device, and e-mail security as well as operations and threat management, monitoring, and response. Our CISO, CIO and CFO are responsible for determining that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the SLT and Board of Directors.


text: Our cybersecurity incident response plan provides that our ERM, strategic crises management coordinator is informed about significant cybersecurity incidents for escalation to our internal Incident Disclosure Committee, SLT, and Board, as appropriate in accordance with our strategic crisis management action plan. Our cybersecurity incident response team is responsible for maintaining our cybersecurity incident response plan, which is periodically tested through our tabletop exercises. We have involved outside experts, our strategic crises management coordinator, members of our SLT, and members of our Incident Disclosure Committee in our tabletop exercises and preparedness drills to strengthen these response plans.


text: Additionally, our Corporate Cybersecurity Steering Committee, chaired by the CISO and whose members include our Senior Vice President, Corporate Controller (our principal accounting officer), as well as other members of the information technology, finance, supply chain, security and facilities, research and development, product, human resources, and legal teams, meets regularly to provide a forum for senior leaders and key stakeholders to strengthen their understanding and strategize on managing cybersecurity challenges at the Company.


text: Board of Directors and its Audit/Finance Committee Our Board and its Audit/Finance Committee exercises oversight over our enterprise risk management including our cybersecurity program. The Audit/Finance Committee receives updates from our CIO or CISO at each of its regularly scheduled meetings regarding matters related to information technology and cybersecurity including the state of the Company's cybersecurity programs, emerging cybersecurity developments and threats, and the Company's strategy to mitigate cybersecurity risks. Additionally, our full Board receives reports on our cybersecurity program at least annually which includes a review of our cybersecurity incident response plans which are described above.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: ZYNEX INC

ticker: ZYXIQ


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees mechanisms to detect and monitor unusual network activity and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems, and have processes to assess those issues for potential cybersecurity impact or risk.


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: We are establishing incident response, business continuity, and disaster recovery plans designed to more formally address our response to a cybersecurity incident.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct basic security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the System and Organization Controls (SOC) reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, such as a managed security service provider to augment the Company's incident response team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is an element of this program. Our cybersecurity risk assessment and management efforts are led by our Director of Information Technology, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our Director of Information Technology reports directly to our COO. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: CytoDyn Inc.

ticker: CYDY


text: We have engaged external parties, including risk management consultants and computer security firms, to enhance our cybersecurity oversight. In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.


text: Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.


text: Our management periodically evaluates information provided by consultants on evolving cybersecurity risks and, based on management's assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.