text: We do not store any customer data input during the reservation process. The customer reservation systems are specified, implemented, and managed by the global hotel brands.


text: Each hotel or operating asset within our portfolio is a standalone network. Therefore, if a security breach were to occur at one location, it is fully isolated from other properties or networks.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA

secItem: Item 1C


text: We deploy stringent email filtering that prohibits incoming messages from insecure email systems (i.e., gmail, yahoo, aol, etc.) that are known to carry viruses, spyware, crypto ransom, etc. We perform regular internal and external penetration tests at the hotel property level.


text: We have in place a Cybersecurity Incident Response plan that dictates the process for responding to incidents and remediation of events. We have relationships with third-party business partners to assist with cybersecurity as well as assess their cybersecurity risks.


text: We utilize Self-Assessments using industry standards and benchmarks to identify cybersecurity incidents and threats that could potentially impact the company.


text: Our IT internal controls are audited by an external audit firm as part of our Sarbanes-Oxley Act compliance activities, and this process includes assessing the design and operating effectiveness of those controls.


text: We or our third-party manager currently maintain cybersecurity insurance policies that provide coverage for security incidents. Although the risks we face from cybersecurity threats are many and change daily, in the last three fiscal years, we have not experienced any cybersecurity incidents that have materially affected our operations, strategy, financial positions or operations. In addition, as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations and financial condition. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors-Risks Relating to Our Business- We are increasingly dependent on information technology, and potential cyber-attacks, security problems or other disruption and expanding social media vehicles present new risks."


text: Despite the policies and procedures that have been implemented to ensure the integrity of our IT systems, we may not be effective in identifying and mitigating every risk in which we are exposed to, especially newly identified vulnerabilities. Furthermore, the hospitality environment requires that the hotels access information in third party environments that are managed, hosted, and provided by others. As such the company will have difficulties in anticipating and implementing preventive measures that mitigate the harm should a break occur.


text: Malicious actors, which can operate on a larger and more sophisticated scale, are using various tools and methodologies to gain access to systems. Such attacks are ransomware, denial of service attacks, phishing, social engineering, and other cyberattacks. A breach of these systems either managed by us or a third party may result in the loss of business data, personal information, disruption of business.


text: Our board of directors are responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On a quarterly basis, our board of directors and audit committee receive a report from management on our cybersecurity threat risk management processes and strategies. Outside of quarterly meetings, our board of directors and audit committee are notified following any cybersecurity incident and meet to address and identify the cybersecurity threat's severity levels. Our board of directors and audit committee also review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.


text: Our accounting and financial reporting platforms and related systems, and those that we, or our third-party service providers, offer to TPHGreenwich's tenants are necessary for the operation of our business. We use these platforms and systems, among others, to manage our tenant relationships, for accounting and financial reporting, and for other recordkeeping purposes. Our business operations and financial reporting rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Trinity Place Holdings Inc.

ticker: TPHS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, hardware and software, and our critical data, including financial information and other confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on our management and third-party service providers to manage any perceived cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, internal controls within our accounting and financial reporting functions, network security controls, access controls, physical security, systems monitoring, and employee training.


text: We work with third parties from time to time that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms and information technology consulting and support firms. To operate our business, we utilize certain third-party service providers to perform a significant portion of our critical functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. To address risks associated with third-party service providers, we will review and assess the cybersecurity controls of our third-party service providers and make changes to our business processes to manage these risks. This approach is designed to mitigate risks related to data breach or other security incidents originating from third-party service providers.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Steven Kahn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Kahn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2015. Mr. Kahn currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Kahn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any serious cybersecurity incidents to our Board.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development, to communicate internally and externally, to operate our accounting and record-keeping functions, to store and access data including sensitive patient data and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Solana Co

ticker: HSDT


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or patients, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.


text: In coordination with third-party consultants, we have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct annual reviews and tests of our information security program to evaluate its effectiveness and improve our security measures and planning.


text: To operate our business, we utilize certain third-party service providers and vendors to support a variety of functions. We seek to engage reliable, reputable service providers and vendors that maintain cybersecurity programs, and we implement a vetting process to ensure that all third-party service providers and vendors comply with our cybersecurity program requirements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. Oversight of such cybersecurity risks is executed directly by the Board of Directors. The Board receives reports and engages in regular discussions with management regarding the Company's significant risk exposures resulting from material cybersecurity threats and the measures implemented to monitor and reasonably manage these risks.


text: Our Director of Information Technology leads our information security organization and reports to our Chief Executive Officer and Chief Financial Officer on matters related to cybersecurity who then in turn report to the Board of Directors any material information regarding such cybersecurity matters. Our Director of Information Technology has over 30 years of IT experience and has developed a focus of experience in the healthcare industry.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Corvus Pharmaceuticals, Inc.

ticker: CRVS


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee has received reports from management on our cybersecurity risks and will receive such reports on a periodic basis going forward. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities which include those related to cybersecurity.


text: As part of our management team, Leiv Lea, our Chief Financial Officer, who has over fifteen years of experience overseeing information technology systems for public companies, is responsible for assessing and managing our material risks from cybersecurity threats. Mr. Lea has primary responsibility for our overall cybersecurity risk management program and supervises our retained external information technology and cybersecurity consultants. Mr. Lea supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from security personnel and alerts and reports produced by security tools deployed in the Company's information technology environment.


text: Juniata's risk management program is designed to identify, assess and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Juniata's Information Security Officer ("ISO") and SVP/IT Manager are primarily responsible for the cybersecurity component of the risk management program and are key members of the organization, both of which have a clear line of reporting directly to the Board of Directors and are involved with management's Information Technology ("IT") Steering Committee. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Juniata's policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats are based on the framework established by the Federal Financial Institutions Examination Council ("FFIEC") Guidelines and Cybersecurity Assessment Tool ("CAT"), which consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. The FFIEC CAT tool will no longer be updated after August 31, 2025, therefore, JVB will replace this tool with another tool such as the NIST 2.0 standard.


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act 12 CFR 364, Appendix B, integrating people, technology, and processes. The program includes company-wide employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management and incident response. Juniata's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse its systems or information. The information security program is periodically reviewed by the Company's SVP/IT Manager and ISO with the goal of addressing changing threats and conditions.


text: The Company also employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. The Company established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. Juniata engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also actively monitors its email gateways for malicious phishing email campaigns and remote connections as some of its workforce has the option to work remotely.


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, particularly in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Management Policy, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the FFIEC guidelines for third-party risk management. The Vendor Management Policy is audited periodically in accordance with the Board of Directors approved Internal Audit plan.


text: Juniata leverages internal and external auditors and independent external partners to periodically review its processes, systems and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted, by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: The Company maintains a Business Continuity Plan (the "Plan") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board of Directors-approved management committees, as discussed further below, and to the IT Steering Committee. The Plan is coordinated through the SVP/IT Manager and ISO, and key members of management are embedded into the Plan by their design. The Plan facilitates coordination across multiple parts of the Company and is evaluated at least annually.


text: Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents;


text: Coordinating incident response or crisis management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents;


text: Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures;


text: Providing company-wide training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plan; and Reviewing the Plan at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: Management has overall responsibility for risk oversight. The Company's SVP\IT Manager is accountable for managing enterprise information security and delivering the information security program. These responsibilities include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third party risk management and business resilience as it relates to the cybersecurity program.


text: The foregoing responsibilities are covered on a day-to-day basis by the SVP/IT Manager and ISO. The ISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 23 years of cybersecurity experience, 19 of which has been spent at a CPA firm specializing in banking industry financial and information technology audits. The ISO provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Board of Directors.


text: The IT Steering Committee focuses on technology and business impact and is responsible for overseeing the Company's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The ISO and SVP/IT Manager provide quarterly reports to the IT Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes. The IT Steering Committee reviews and approves the information security and technology budgets and strategies annually.


text: The IT Steering Committee focuses on the identification, monitoring, assessment, and management of risk associated with the Company's cyber and information security programs. The IT Steering Committee reviews key metrics summarizing the Company's cyber security risk profile on a quarterly basis.


text: Both the IT Steering Committee and the Board of Directors provide oversight and governance of the technology program and the information security program. Both committees meet at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan (part of the Plan) to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity incidents discussed at committee meetings and the actions taken to the IT Steering Committee on at least a quarterly basis, or more frequently as may be required by the Incident Response Plan, and to the Board of Directors on at least an annual basis. Additionally, the ISO reports directly to the Board of Directors, at least annually, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing security breaches or violations are discussed, as are management's responses and any recommendations for program changes.


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Village Bank & Trust Financial Corp.


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge and testing; using a third-party cybersecurity oversight program;


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and We had no material cybersecurity incidents in 2024.


text: Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside partners to assist us in overseeing our cybersecurity risk management program.


text: We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.


text: While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Risk Committee, or to the full Board, as appropriate.


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Our Board Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Board Risk Committee actively engages with our Chief Risk Officer and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Board Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Board Risk Committee is engaged, as needed, in accordance with our Incident Response Plan.


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our Chief Risk Officer is responsible for implementing our enterprise risk management framework and reports directly to our Chief Executive Officer.


text: Our first line of defense is our employees. Employees receive training, at least annually, on information security. In addition, our Information Security Officer provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials.


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our Management Risk and Compliance Committee, which governs our technology and operational risk tolerances, including cybersecurity and third- and fourth party provider risks. This committee includes the Information Security Officer, the SVP of IT and the Chief Risk Officer. The Committee is responsible for escalating key risks to our Executive Leadership Team.


text: Internal Audit serves as the third line of defense and provides independent assurance on how effectively we are mitigating, managing, and challenging our cybersecurity risks.


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, as well as confidential information that is proprietary, strategic or competitive in nature.

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR


text: The Company's information technology department helps identify, assess and manage Capricor's cybersecurity threats and risks. The information technology department, in coordination with the finance and/or legal departments, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, evaluating threats reported to us, conducting audits, performing threat assessments, and conducting vulnerability assessments to identify vulnerabilities. We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, and cybersecurity software providers. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business. The Company is currently in the process of implementing a cybersecurity oversight committee to enhance governance and ensure dedicated focus on cybersecurity risk management. This committee will work closely with the board to provide regular updates on the organization's cybersecurity posture, performance, and emerging risks, while ensuring that cybersecurity strategies align with business objectives and regulatory requirements.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors included in Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K, including "Risk Factors — Risks Related to our Business — A breakdown, corruption or breach of our information technology systems or computer systems, or those used or hosted by our CROs, contractors, consultants or third-party vendors could subject us to liability or interrupt the operation of our business."


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. As of the date of this report, we have not experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, research, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, future lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, and harm to our vendor relationships.


text: Cybersecurity Risk Management and Strategy We, through our third -party service provider that manages our information technology systems and networks, have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: FENNEC PHARMACEUTICALS INC.

ticker: FENC


text: Our security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, ensure maintenance of backup and protective systems, and engage with a Managed Service Provider who has a team of security personnel managing our efforts and initiatives. We review System and Organization Controls 1 (SOC 1 Type II) certifications where relevant from key third party partners and other service providers with access to information assets at least annually.


text: We maintain Information Systems Incident Management Standards that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our internal controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment designated team members are responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and Maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any cybersecurity threats that have materially affected the Company.


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversees our cybersecurity and other information technology risks and management's implementation of our cybersecurity risk management program.


text: Our Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board and the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program and supervises our retained provider of IT services and external cybersecurity consultants. Our Chief Financial Officer has experience supervising and managing company security and privacy departments.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the IT environment.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer (ISO) and virtual Chief Information Officer (CIO) is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the President and Chief Executive Officer, as discussed below, periodically to our board of directors.

companyName: Fifth District Bancorp, Inc.

ticker: FDSB


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our system or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence fees to facilitate and promote program effectiveness. Our Computer Systems Operations Manager and Information Security Officer, who report directly to our board of directors, regularly collaborate with peer banks and industry groups to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and reliance tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using third-party cybersecurity experts. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the board of directors. The Incident Response Plan is coordinated through the Computer Systems Operations Manager and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company.


text: Our Computer Systems Operations Manager is accountable for managing our enterprise information security function and delivering our information security program. The responsibilities of this position include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors. The function, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals responsible, including third-party vendors, are generally subject to professional education and certification requirements.


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and its business impact. This committee provides oversight and governance of the technology program and the information security program. This committee includes the Information Security Officer (Senior VP of Operations), the Computer Systems Operation Manager, the virtual Chief Information Officer and other members of senior management. This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Computer Systems Operations Manager and Virtual Chief Information Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the board of directors on an annual basis (or more frequently as may be required by the Incident Response Plan).


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The board of directors reviews and approves our information security and technology budgets and strategies annually.


text: Cyber Risk Management and Strategy We rely on information technology systems that we or our third-party providers operate to process, transmit and store electronic information in our day-to-day operations. To help protect against risks from cybersecurity threats to these systems, we have implemented cybersecurity processes in accordance with our risk profile and business that are informed by a recognized cybersecurity industry standard.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: Our cybersecurity risk management process includes a number of components implemented by internal and external resources, including security monitoring tools, penetration tests and vulnerability assessments, and employee cybersecurity awareness training. We also engage the services of external partners who provide information security services to help maintain our hardware and software, assist with security monitoring on our devices, and help us draft and implement appropriate information security policies.


text: As part of our cybersecurity risk management process, we take a risk-based approach to the evaluation of third-party vendors based on the criticality and size of the vendor. This process includes a review by our external partners, as appropriate.


text: Related to Cybersecurity Risks Our President meets regularly with representatives from our external partners to, as applicable, review aspects of the Company's cybersecurity processes or evaluate risks from cybersecurity threats.


text: Management, including our President and Chief Financial Officer, reports to the Audit Committee on our major cybersecurity risk exposures, their potential impact on us, and the steps we take to manage them. The Audit Committee considers the Company's cybersecurity risk exposures and the steps that the Company's management has taken to monitor and control such exposures in connection with the Audit Committee's discussion of the Company's risk assessment and management guidelines.


text: The Audit Committee reviews and discusses, at least annually, the Company's cybersecurity risks, including the Company's information security and risk management programs, controls and procedures, as well as high level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential security incidents. The Audit Committee also reviews the recovery and communication plans for any unplanned outage or security incident.


text: The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents. The Audit Committee provides updates to the board of directors regarding such oversight.


text: We depend on a variety of information systems and technologies to maintain and improve our competitive position and to manage the operations of our business, including supply chain, merchandising, point of sale, e-commerce, marketing, finance, accounting, and human resources. Our core business systems consist mostly of purchased software programs that integrate together with our internally developed software solutions across a company-wide network that connects all corporate users, stores, and our distribution center infrastructure.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: We manage data security and privacy at the highest levels. The Company's Board of Directors oversees an enterprise-wide approach to risk management (ERM), designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. Management is responsible for the Company's day-to-day risk management activities and processes, and our Board's role is to engage in informed oversight of, and provide guidance with respect to, such risk management activities and processes. The Company's cybersecurity policies, standards, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, proactive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Collaborative Approach. The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt identification and escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards. The Company's Security Operations Center, led by our Vice President IT Risk Management (Chief Information Security Officer), constantly and proactively monitors our network and application landscape for threats and anomalies. The Security Operations Center deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response Plan. The Company has established and maintains a comprehensive incident response plan that addresses the Company's response to a cybersecurity incident.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: All Ulta Beauty associates have a role as stewards of Company data, and we educate them on how to keep data safe. As part of the Company's annual security awareness training and regular training around phishing, we train associates on how to keep devices and data safe in public places; how to avoid security threats and phishing scams; how to maintain a secure workplace; and everyday practices that help maintain the security of corporate digital devices, data and systems.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. We assess ourselves against the National Institute of Standards and Technology Cybersecurity Framework, Payment Card Industry Data Security Standard and management's defined technology controls to support internal controls over financial reporting. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness, including network penetration assessments. The results of such assessments, audits, and reviews are reported to the Audit Committee of the Board and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Also see "Information Security, Cybersecurity, Data Privacy, Regulatory and Legal Risks" included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: The Company's Board of Directors is actively engaged in oversight of cybersecurity, and it is part of the responsibilities of our Audit Committee. The Company's Chief Technology and Transformation Officer (CTTO) and President and Chief Executive Officer keep the Board informed on cybersecurity and privacy matters throughout the year, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CTTO and our Vice President IT Risk Management. The Company's CTTO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. To facilitate the success of the Company's cybersecurity risk management program, we have a unified and centrally coordinated team, led by our Vice President IT Risk Management, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with senior leadership and other teams across Ulta Beauty. Reporting to our Vice President IT Risk Management are a number of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: The Company's CTTO leads the core elements of Ulta Beauty's IT and Digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology. He has served in various roles in information technology and information security for over 30 years, including serving as the Global Chief Technology Officer of a large public company prior to joining the Company. The Vice President IT Risk Management leads our information risk management organization responsible for overseeing the Company's information security program. She has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.


text: We recognize the importance of safeguarding our business operations, sensitive data, and intellectual property from cyber threats and other technological risks. Our operations involve the use of various information technology systems, including those for production management, customer order management, and financial reporting. As such, we are exposed to a range of cyber risks, including but not limited to data breaches, ransomware attacks, unauthorized access to proprietary data, and disruptions to our operations due to system failures. We are committed to maintaining an appropriate level of cybersecurity to mitigate these risks. Lendway's cyber environment at December 31, 2024 consisted primarily of outsourced information technology ("IT") operations. The outsourced providers have a cybersecurity framework which includes multiple products implemented to ensure the security of Lendway's and Bloomia's environments. Our third-party service providers alert management, specifically the CFO and CEO of Bloomia, to incidents or other concerns. Management reports significant incidents or concerns to the Audit Committee.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: Annual internal and external vulnerability scans are completed to ensure we mitigate any risks proactively. The Company's internal operations are PC based and the PCs have up to date security software. Regular phishing exercises are conducted, and employee awareness training is conducted annually by our outsourced provider.


text: The Company relies on third-party service providers for services such as IT management and payroll. These third-parties are also vulnerable to cybersecurity threats. Management actively assesses its third-parties policies related to cyber risks, including obtaining System and Organization Controls (SOC) reports, when available.


text: Our full Board of Directors and our Audit Committee provide oversight of our risk management program, which includes cybersecurity and monitoring the performance of our third-party IT providers. The Audit Committee, as part of its charter to review the Company's practices with respect to risk assessment and risk management, receives updates on internal control, including those relating to IT general controls and cybersecurity.


text: As of the date of this report, we did not identify any cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. Third parties are also incorporated into our approach to cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, cybersecurity maturity assessments or consulting on best practices to address current and new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: Precipio, Inc.

ticker: PRPO


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our IT Manager and Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Operating Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Operating Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.


text: Our approach to managing cybersecurity risk involves a comprehensive program established at each subsidiary and our corporate headquarters. This strategy intends to pinpoint entity-specific risks associated with both our digital and physical assets with the objective of employing effective measures that ensure the security of our infrastructure, systems, data, business partners, customers, and financial information against potential cyber incidents. Corporate management of the holding company oversees the cybersecurity risk program at each of the subsidiaries to ensure the collective cohesively responds to organization-wide risks.

companyName: ARGAN INC

ticker: AGX


text: Administered by information security, information technology, and compliance professionals and managed by senior management at each of our subsidiaries, our cybersecurity program is integrated into our broader enterprise risk management process and aligns with recognized frameworks and industry standards, as applicable, and complies with various legal and regulatory requirements.


text: The audit committee of our board of directors oversees management's cybersecurity program and ensures timely reporting and management of cyber incidents.


text: As our business objectives and operational needs change, our cybersecurity professionals continuously evaluate and refine the measures taken to address our identified risks for each subsidiary. Our technical measures, based on each subsidiary's environment, may include firewalls, segmented networks, intrusion detection and prevention systems, encryption, anti-malware tools, and configuration controls, to shield our information systems from cybersecurity incidents. Additionally, we apply strong access controls, enforce multi-factor authentication, and regularly update software and patches against vulnerability exploitation.


text: We use managed endpoint detection and response tools to proactively monitor, detect, and respond to security threats across all endpoints, including desktops, laptops, and mobile devices. These tools provide real-time visibility into endpoint activities, allowing us to identify suspicious behavior, such as malware infections, unauthorized access attempts, and abnormal system processes.


text: We maintain business continuity plans that define how our critical operations will continue during disruptions, ensuring minimal downtime and seamless access to vital services. Our comprehensive disaster recovery plans include regularly testing backup systems and clear procedures for restoring critical business applications in the event of data loss, cyberattacks, or natural disasters. This multi-faceted approach ensures that, even in the face of unexpected incidents, our subsidiaries and organization can quickly recover, maintain operational resilience, and protect the data and services that are essential to our success.


text: Acknowledging the dynamic and complex landscape of cybersecurity threats, we engage with various external specialists to evaluate and strengthen our information security practices and procedures. Such engagements differ across our subsidiaries, as they are tailored to the specific risk profile of each subsidiary, ensuring that each entity works with experts most suited to their specific cybersecurity needs. These engagements, which may encompass regular audits, risk assessments, gap assessments, social engineering and penetration testing, and consultations on security enhancements, enable us to align with industry best practices. Significant results and recommendations of these assessments are reported to the audit committee and, as necessary, the board of directors, leading to adjustments in our cybersecurity approach to ensure our defenses remain robust and effective.


text: During Fiscal 2025, GPS hired a cybersecurity engineer whose mission is to design and implement a comprehensive cybersecurity architecture that elevates the current risk management and strategy while leveraging existing platforms, policies and best practices.


text: Recognizing the importance of human factors in cybersecurity, we prioritize conducting regular security and awareness training for employees that emphasizes common threats, such as phishing, social engineering, sensitive data exposure, and insider risks. These initiatives are designed to ensure that employees understand the latest security threats, best practices, and how to recognize potential risks. In addition to regular training sessions, we also perform simulated exercises, such as phishing drills, to reinforce learning and test employees' ability to respond to real-world threats. Lastly, we regularly share security updates and reminders through internal communications and provide dedicated means for employees to report attempted threats.


text: To mitigate cybersecurity risks linked to our engagement with third-party service providers, we perform security screening and review for prospective vendors that require access to our information systems. Based on the subsidiary and the vendor, this process may include reviewing the vendor's data protection policies, assessing their ability to meet our security requirements, and ensuring that they have adequate safeguards in place to prevent and respond to breaches. For our ongoing relationships with regular vendors, we may conduct annual risk assessments to re-evaluate their security posture, identify any changes or emerging risks, and ensure that they continue to meet our standards. Additionally, to further protect our operations and enhance our cybersecurity risk management process, we maintain cybersecurity risk insurance obtained from industry leading underwriters.


text: Our strategy for responding to cybersecurity incidents involves a well-defined plan at each subsidiary that prescribes dedicated cross-functional personnel to each response team, ensuring a coordinated and premeditated response. These plans, which undergo regular review, assert the ability of system recovery processes and provide response frameworks for escalating issues. The plans are designed to minimize the impact to our operations and stakeholders, initiate appropriate communications both within and outside of the organization, and identify recommendations for improvement.


text: While our management team is tasked with the day-to-day handling of risks facing our organization, the audit committee, as delegated by the board of directors and documented in the committee's charter, specifically oversees cybersecurity risk and governance. Management provides the audit committee regular updates covering information security issues, recent organizational developments and IT initiatives, vulnerability assessments, third-party evaluations, and emerging best practices. The audit committee also engages with our internal audit firm and other external specialists about organizational risks related to cybersecurity, as well as the policies and controls designed to mitigate these risks. In January 2024, our board of directors participated in a cybersecurity training session provided by our internal audit firm. Our audit committee or the board of directors is actively involved in strategic cybersecurity decisions, providing guidance and concurrence for significant or pervasive projects. This ensures that cybersecurity is seamlessly integrated into our strategic planning, aligning with our broader organizational goals.


text: Additionally, we have established a cross-organizational IT steering committee, comprising senior and executive leadership, enterprise risk management representatives, and IT management, many of whom have over 15 years of experience and hold professional certifications in their respective fields. In an effort to build a comprehensive cybersecurity strategy across the organization, this committee convenes as needed to discuss ongoing cybersecurity initiatives, emerging regulatory requirements and industry standards, and results of risk assessments.


text: Cybersecurity incidents are regularly reported to cross-functional teams at each subsidiary through the dedicated means we have in place, and events deemed critical are reported to the chief executive officer and chief financial officer. Moreover, the audit committee and the board of directors are promptly informed of any significant cybersecurity incident, along with continuous updates until resolution.


text: Cybersecurity Risks, Threats and Material Incidents Despite our endeavors to safeguard the security and integrity of our networks, systems, and the sensitive information they contain or transmit, including the adoption of numerous cybersecurity policies and protocols aimed at mitigating the risk of cybersecurity breaches or disruptions as previously outlined, it is impossible to guarantee the complete effectiveness of these measures. There remains a possibility that efforts to thwart cybersecurity threats may not be entirely successful, potentially resulting in successful breaches or disruptions that could be harmful. Refer to "Our failure to protect our management information systems against security breaches could adversely affect our business and results of operations" in Item 1A. Risk Factors.


text: As previously disclosed, we were targeted by a complex criminal scheme early in Fiscal 2024, which resulted in fraudulently-induced outbound wire transfers to a third-party account (see Note 18 to the accompanying consolidated financial statements). The Company promptly self-discovered the fraudulent activity and contacted the remitting bank, receiving bank, dispute resolution experts, and federal and local law enforcement authorities. Moreover, we quickly informed the audit committee and regularly provided them with updates during investigation and recovery efforts. As a result of the fraud loss, net with funds recovered, and professional fees incurred related to an independent forensic investigation and efforts to recover the funds, we recognized $2.7 million of loss. We are unaware of any other significant security breaches at any of our business locations.


text: We do no believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. During the reporting period, we have not experienced any material cybersecurity incidents nor any series of immaterial cybersecurity incidents that would require to be disclosed in this year-end report Management of cybersecurity risks is a component of our overall risk management strategy. We rely on information technology, communication networks, enterprise applications, accounting and financial platforms, and related systems in the operation of its business. Our operations also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data. Our cybersecurity risk management strategy is designed to support us in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents with the intention of protecting the confidentiality, integrity, and availability of such systems and data.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: We have implemented several processes with the assistance of third parties that we engage to help us manage our overall information technology function. These include certain processes for assessing, identifying and managing cybersecurity risks and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack, as well as to secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and periodic review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and governance experts, to enhance our cybersecurity oversight and to gain valuable insights into the ever-evolving cybersecurity landscape.


text: Our use of third parties to conduct our business is significant. We use suppliers, CROs, CDMOs, and other service providers. A cybersecurity incident at third party could materially adversely impact us. In order to mitigate this risk, we assess third party cybersecurity controls prior to engaging third parties and include security and privacy addendums to our contracts where applicable. We also require that third party service providers or partners report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: In an effort to further deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention materials, which educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks.


text: Lastly, we have established a Cybersecurity Incident Response Policy ("CIRP"), which details the steps to be followed to properly respond to, contain, and remediate a cybersecurity incident. The CIRP provides a process for escalating certain cybersecurity incidents to the Board and members of management to facilitate management-level consideration as to whether a cybersecurity incident may be material to the Company and whether public disclosure of the incident is required.


text: Our third-party service providers report to our Principal Financial Officer who is responsible for the management of the Cybersecurity program. The Principal Financial Officer, on a regular basis, reports to the Audit Committee.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: The Company's Information Security Program ("Program") uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as the National Institute of Standards and Technology (NIST), Financial Services Information Sharing and Analysis Center (FS-ISAC), Federal Financial Institutions Examination Council (FFIEC), and Ransomware Self-Assessment Tool (R-SAT), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.


text: The Company's third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party's operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations include reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.


text: We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at the required new employee orientation and subsequently receive information security tips via email. Employees also receive annual security awareness training.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant.


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cybersecurity matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts to accommodate for the ever-evolving information and cybersecurity threat landscape. The Information Security Officer ("ISO") regularly updates the Board, management and any appropriate committees on the information and cybersecurity risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.


text: The Chief Operating Officer (COO) along with the ISO are responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our COO and ISO have over 25 years of combined related experience. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises and incorporate external resources and advisors as needed. The Program is overseen by the Information Security Committee, Board of Directors, and Compliance Committee.


text: The Company's Board of Directors monitors the Program including policies and practices. The Company's Compliance Committee and Information Security Committee along with the company's Board of Directors oversee areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The ISO also provides periodic cybersecurity updates to the Board of Directors.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial condition, to date. Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions and our business may be adversely affected by security breaches at third-parties.


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various industry standard security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Given the prevalence of social engineering attacks, we have implemented a two-pronged approach of training and security mitigations: educating users about how to detect a potential attack (phishing, malware, etc.) and security tools, which can decrease the likelihood of occurrence through multi-factor authentication, endpoint detection and response and other tools focused on locking down cyber threats. A team of industry experts comprised of representatives from our Information Technology department and support functions, along with outside experts assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Executive Leadership Team and Audit Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors. These mitigations target implementing automated tools for detection and prevention wherever possible, supplemented by training and process controls as needed. Recurring maintenance, reporting and awareness tasks are conducted and documented within our Service Management Software and Security tools for record keeping and trending.

companyName: Neuronetics, Inc.

ticker: STIM


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes through various penetration testing and best practice reviews. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We are aware that cybersecurity is a continually changing landscape and as a result, the engagement with these experts helps us evaluate our risk-based processes with respect to the trends.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "Security and privacy breaches may expose us to liability and harm our reputation and business " in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of emerging industry-wide trends in cybersecurity risks along with specific risk areas our company has greater risks throughout the year, including, among others, those relating to cybersecurity threats. These reports come from the Company's Chief Information and Operations Officer (the "Head of IT") to include our enterprise risk profile on a quarterly basis. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are industry-standard metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Head of IT is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Head of IT has over 20 years of experience in information security and possesses the requisite education, skills and experience expected of an individual assigned to these duties. In addition to individual skills, the Head of IT has partnered with several third-party Cybersecurity experts to identify new areas of risk and the latest trends in security tools and methods.


text: We maintain standard procedures to help assess, identify and manage material risk posed by cybersecurity threats and regularly evaluate how we can integrate these procedures into our overall risk management processes. For example, we require that all of our employees who have access to our internal network complete formal cybersecurity training upon hire and on a periodic basis, including training on phishing, malware, and other cybersecurity risks. We also continuously evaluate our information technology systems and our practices that relate to our information technology systems. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with these efforts but may elect to do so in the future.

companyName: BIO-PATH HOLDINGS, INC.

ticker: BPTH


text: To the extent we identify areas in our information systems that need improvement, we seek to timely implement and monitor such improvements. While we believe that we have taken appropriate security measures to protect our data and information technology systems, and have been informed by our third-party vendors that they have as well, there can be no assurance that our efforts will prevent breakdowns or breaches in our systems, or those of our third-party vendors, that could materially adversely affect our business and financial condition. For additional information regarding whether risks from cybersecurity threats are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the functions of our Board is to identify principal risks of the Company and ensure implementation of appropriate systems to manage these risks, including risks from cybersecurity threats. Our Board works with members of management to identify and manage these risks, including cybersecurity risks. We currently employ a qualified Director of Information Technology and Data Management Systems who reports to our Chief Executive Officer. This employee has over 20 years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.


text: Our information technology employee regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. To the extent necessary, our Chief Executive Officer reports such risks to our Board.


text: We have developed and implemented a cybersecurity framework intended to identify, assess, monitor and manage risks from cybersecurity threats to the security of our information, systems and network using a risk-based approach. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although our framework takes into account the particulars of our business and our diverse network of terminal operations and therefore does not meet all the technical standards, specifications or requirements under the NIST. Additionally, the Company follows IT General Controls that were implemented to adhere to Sarbanes-Oxley internal controls.

companyName: TransMontaigne Partners LLC


text: We contract with external firms to assess the Company's cybersecurity framework. In connection therewith, such firms conduct cybersecurity risk assessments, cybersecurity incident response, provide internal and external penetration testing and ongoing training to our Cybersecurity Group. The Company maintains a cybersecurity insurance policy. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems and third-party service providers.


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. The Company maintains a variety of incident response plans that would be deployed in the event that a cybersecurity incident were detected. We require all of our employees to undertake data protection and cybersecurity training and compliance programs on an annual basis, which are administered and tracked through online learning modules.


text: Our critical business systems are fully redundant and backed up at separate locations. Separate business and SCADA networks allow for isolation of potential threats and enhance the security of these systems. We maintain a dedicated SCADA department, staffed around the clock, to evaluate and respond to significant events and incidents that may impact our pipeline operations. Anti-virus solutions are deployed on our SCADA systems and workstations in our data centers and control centers.


text: Our Cybersecurity Group oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. Our Director of IT Infrastructure, who has extensive cybersecurity knowledge, training and skills gained from over 30 years of work experience on cybersecurity and from technology leadership roles in the energy industry, heads the Cybersecurity Group responsible for implementing and maintaining our cybersecurity and data protection practices. The Director of IT Infrastructure reports directly to our Chief Financial Officer.


text: Significant threats are reviewed by the Cybersecurity Group to determine whether further escalation is appropriate. Any cybersecurity threat or incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to designated members of our executive management team; namely our Chief Financial Officer, Chief Operating Officer and General Counsel, who, in addition to the Director of IT Infrastructure, are responsible for overseeing and managing material risks from cybersecurity threats. Further, the Company provides an annual cybersecurity assessment to ArcLight.


text: To date, our business strategy, results of operations and financial condition have not been materially affected, nor are they reasonably likely to be affected by risks from cybersecurity incidents or threats. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from our Board of Directors (the "Board"), Audit Committee, employees and third-party experts. The Board, Audit Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology ("IT") team reviews cybersecurity risks periodically, and we have a set of Company-wide policies and procedures concerning cybersecurity matters, including policies related to encryption standards, remote access, multi factor authentication, confidential information, the use of the internet, social media, email and wireless devices and incident response. These policies go through an internal review process by members of management and appropriate Board committees, as applicable.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU