text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. TPG's cybersecurity team itself performs both automated monitoring on a continuous basis and manual reviews of key controls. TPG has informed us that it also conducts annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform its evaluation. This does not imply that TPG, its affiliates or we fully meet any particular industry standards, specifications, or requirements. In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG's internal audit team on a periodic basis. We also engage external providers to conduct periodic external assessments, including penetration testing.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Company, Business, and Operations—Cybersecurity risks may cause a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business. ", for additional discussion about cybersecurity-related risks.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT

secItem: Item 1C


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Board regularly engages in discussions with management regarding the Company's risk assessment and risk management policies. In addition, the Audit Committee of our Board of Directors (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks.


text: Our Board of Directors, including the Audit Committee, is briefed on our Manager's information security program and cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports at least annually to our Board of Directors, including the Audit Committee, and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As an externally managed company, we rely on our Manager and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our Manager's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within the organization, including compliance, human resources, internal audit and legal. The CISO leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program. TPG's CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period. TPG has informed us that the CISO holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). TPG's cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. TPG's cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity threats and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, threat modeling, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: Bandwidth Inc.

ticker: BAND


text: Our enterprise-wide information security program is designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Cybersecurity risks related to our business, network, and operations are identified and addressed through a multi-faceted approach including third party assessments, as well as internal information system and network security, governance, risk and compliance reviews.


text: To defend, detect and respond to cybersecurity incidents, we (i) conduct proactive privacy and cybersecurity reviews of systems and applications, (ii) audit applicable data policies, (iii) perform penetration testing internally and with external independent third-parties to test our security controls, (iv) conduct employee training, (v) monitor emerging laws and best practices related to data protection and information security and (vi)


text: implement appropriate changes. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have implemented incident response and breach management processes, which have four overarching and interconnected workflows: (1) detection and analysis of a security or privacy incident, (2) investigation, mitigation and remediation, (3) reporting and notification, and (4) post-incident analysis. Such incident responses may involve participants from our information security, network, information Technology, development, executive and legal teams.


text: We also conduct exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals collaborates with technical and business stakeholders across our business units to further analyze the risks to the company and form detection, mitigation and remediation strategies.


text: As part of the processes described above, we regularly engage external auditors and consultants to assess our cybersecurity programs and compliance with applicable practices and standards. Our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013 and AICPA SOC 2 Type II, which includes all five of the Trust Services Criteria.


text: Our Vendor Risk Management ("VRM") program assesses risks from cybersecurity threats associated with our use of third-party service providers. Under this program, we perform initial risk assessments prior to selecting and engaging third-party service providers as well as ongoing risk assessments in an effort to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. The VRM program is designed to evaluate the cybersecurity and data privacy risks associated with the use of third-party vendors that will be processing, storing, or handling Bandwidth employee, business or customer data. Based on this evaluation, the VRM program records a risk rating, advises on selection or implementation recommendations, and informs contractual terms with the applicable third-party, such as privacy, security, and data protection commitments. In addition to new vendor onboarding, the VRM program includes annual review of critical service providers, ongoing assessment of expanded use cases, and evaluation of potential third-party incidents. We monitor and evaluate reports of third-party cybersecurity threats to identify and mitigate potential risks to us from third-party incidents in our supply chain.


text: Our Application Security program proactively performs static and dynamic scanning of systems and software code. In addition, we perform vulnerability scans daily on our systems and assets.


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner with continuous monitoring from our Security Operations Center. These tools include, but are not limited to, Endpoint Detection and Response, Security Information and Event Management, Attack Surface Management, Static Application Security Testing, Dynamic Application Security Testing, DDoS Mitigation Services, threat detections including intelligence and brand monitoring, intrusion detection sensors, network firewalls and web application firewalls.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. The DDoS attack we experienced in late 2021 did have a material impact on our results of operations. We do face risks from similar attacks and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. Further, an attack on, or penetration of, our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risks. See "Risk Factors - Attacks on or breaches of our networks or systems, or those of third parties upon which we rely, could degrade our ability to conduct our business, compromise the integrity of our services and our communications platform, result in service degradation or outages, significant data losses, the theft of our intellectual property, investigations by government agencies and damage to our reputation, and could expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data."


text: Our board of directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. Our board of directors receives an update on Bandwidth's risk management process at least annually, and receives quarterly cybersecurity updates from our Chief Information Officer ("CIO").


text: Our CIO and our Vice President, Information Security lead our global information security organization and are responsible for overseeing our information security program. Our Vice President, Information Security has over 25 years of industry experience, including serving in similar roles, building, leading and overseeing cybersecurity programs at other private and public companies. Team members who support our information security program have relevant educational and industry experience, including application security, security operations, forensic and incident response, governance, risk and compliance.


text: At the management level, our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, operations, legal and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of our and our customers' information by identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. Our Executive Security Committee, which includes our Chief Operating Officer, our CIO, our Chief Technology Officer, our Chief Development Officer, our General Counsel and other cross-functional participants, meets monthly to evaluate our cybersecurity risks and related response efforts.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. Our enterprise-wide information security program is designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity threats and develop related security controls and safeguards. We conduct regular periodic reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing internally and with external independent third-parties, threat modeling, simulations, and other exercises in an effort to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: We have implemented incident response and breach management processes, which have four overarching and interconnected workflows: (1) detection and analysis of a security or privacy incident, (2) investigation, mitigation and remediation, (3) reporting and notification, and (4) post-incident analysis. These processes may involve participants from our information security, network, information technology, software development, executive and legal teams.


text: From time to time, we also conduct exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals collaborates with legal, technical and business stakeholders to further analyze the risks to the company and form detection, mitigation and remediation strategies.


text: Our Vendor Risk Management ("VRM") program aids in evaluating the cybersecurity and data privacy risks associated with the use of vendors and other third parties that will be processing, storing, or handling Bandwidth employee, business or customer data. The VRM program is designed to evaluate third-party risk, advise on selection or implementation recommendations, and inform privacy, security and data protection contractual terms. We rely, however, on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Our Application Security program performs static and dynamic scanning of systems and software code. In addition, we perform vulnerability scans daily on our systems and assets.


text: With respect to cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner with continuous monitoring from our Security Operations Center. These tools include, but are not limited to, Endpoint Detection and Response, Security Information and Event Management, Attack Surface Management, Static Application Security Testing, Dynamic Application Security Testing, DDoS Mitigation Services, threat detections including intelligence and brand monitoring, intrusion detection sensors, network firewalls and web application firewalls.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. We have not experienced any material cybersecurity events in the last three fiscal years, and expenses incurred in connection with cybersecurity incidents were not material. However, we do face risks from similar attacks and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. Further, an attack on, or penetration of, our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risks. See "Risk Factors - Attacks on or breaches of our networks or systems, or those of third parties upon which we rely, could degrade our ability to conduct our business, compromise the integrity of our services and our communications platform, result in service degradation or outages, significant data losses, the theft of our intellectual property, investigations by government agencies and damage to our reputation, and could expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data," included elsewhere in this Annual Report on Form 10-K.


text: At the management level, our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, operations, legal and compliance stakeholders meet regularly to discuss strategies designed to preserve the confidentiality, integrity and availability of our and our customers' information by identifying and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. Our Executive Security Committee, which includes our Chief Operating Officer, our CIO, our Chief Technology Officer, our Chief Development Officer, our General Counsel and other cross-functional participants, meets monthly to evaluate our cybersecurity risks and related response efforts.


text: Education and Awareness We monitor emerging laws and best practices related to data protection, privacy and information security. We regularly remind employees of the importance of handling and protecting customer and employee data, and our policies require each of our employees to undergo annual privacy and information security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, to protect the confidentiality, integrity and availability of our critical systems and information. Our enterprise risk management program considers cybersecurity threats as part of our overall risk assessment process. We perform these risk assessments to inform our risk mitigation strategies and prioritize cybersecurity initiatives. Our cybersecurity risk assessment process includes network and endpoint monitoring, vulnerability assessments, and penetration testing, and we believe helps identify our cybersecurity threat risks by aligning our processes to standards set by the National Institute of Standards and Technology ("NIST"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The results of our cybersecurity assessments are regularly shared with senior management and the Board of Directors. Additionally, we have implemented technologies, controls and processes to aid in our efforts to assess, identify, manage, and monitor material cybersecurity risks, their severity, and potential mitigation. We regularly review and update our cybersecurity processes to help address the evolving cybersecurity landscape and legal requirements, providing clear guidelines for our employees and third-party service providers.

companyName: SunCoke Energy, Inc.

ticker: SXC


text: Structure and Risk Management Functions Cybersecurity is an integral part of our risk management processes. Our cross-functional risk management team evaluates cybersecurity risks alongside other operational, financial, and reputational risks, facilitating effective resource allocation and coordinated mitigation strategies. In 2021, we updated our Audit Committee charter to memorialize the Committee's role in reviewing cybersecurity matters. The Audit Committee oversees the initial assessment of cybersecurity threats as well as the Company's approach to management and mitigation of such risks, compliance with industry standards related to cybersecurity, and the Company's public disclosures related to cybersecurity matters. In addition, our Board of Directors devotes regular attention to oversight of cybersecurity risks. At least annually, the entire Board of Directors receives an update from our Chief Information Officer ("CIO") detailing our cybersecurity threat risk management and strategy processes. This update covers topics such as data security posture, results from assessments conducted by third parties, progress towards security goals, and any material cybersecurity developments, as well as steps taken in response to such developments. Our governance structure allows senior management and the Board of Directors to also remain involved in our cybersecurity strategy and risk management oversight, creating a comprehensive approach to our risk management.


text: Leadership and Communication Our CIO has experience in various roles implementing effective information and cybersecurity programs. The CIO reports to the Company's Senior Vice President and Chief Financial Officer and maintains open channels of communication with the broader senior management team and the Board of Directors. The CIO leads our cybersecurity initiatives and is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident responses, and providing regular updates to management, the Audit Committee and the Board of Directors regarding the Company's cybersecurity status and risk assessments.


text: External Support and Third-Party Risk Management Management continues to take steps to enhance our data security infrastructure and defenses. Our processes also address cybersecurity threat risks associated with using third-party service providers, including those in our supply chain or who have access to our customer and employee data, our information systems, or the facilities that house such systems or data. We engage outside third-party experts, cybersecurity advisors, and auditors to conduct regular risk assessments, penetration testing, and vulnerability analyses. Our enterprise risk management and cybersecurity-specific risk identification programs include consideration of third-party risks and informs our selection and oversight of third-party service providers. We conduct appropriate due diligence on third-party service providers, vendors, and partners before establishing relationships with them, and we monitor such relationships on an ongoing basis. We also periodically review the Company's cyber insurance policies to ensure appropriate coverage.


text: Incident Response and Vulnerability Management In the event of a cybersecurity incident, our incident response plans are designed to respond with an incident response team to address any breaches. Our ongoing vulnerability management program complements our incident response capabilities. It includes periodic scanning, risk assessment, and patch management to address system and network vulnerabilities and help ensure that our infrastructure remains resilient against evolving threats.


text: As part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and in our MD&A at Item 7 of this Annual Report on Form 10-K, we describe whether and how risks from identified cybersecurity threats, including any previous incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. These disclosures are incorporated by reference herein. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. This includes penalties and settlements, of which there were none.


text: All companies utilizing technology are subject to the risk of breaches of or unauthorized access to their computer systems. The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The Audit Committee of our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats and incidents. Our policies, processes and procedures include, among other things, annual external penetration testing using an experienced third-party company; a cybersecurity incident response and recovery plan; periodic and ongoing security awareness training for employees; the use of several comprehensive vulnerability analysis systems to evaluate software vulnerabilities both internally and externally; and mechanisms to detect and monitor unusual network activity. The Company also requires that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment. We also maintain controls and procedures that are designed to promptly escalate certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board of Directors in a timely manner. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.

companyName: AMC Networks Inc.

ticker: AMCX


text: Our cyber risk management program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity risks are identified and addressed through a comprehensive, cross- functional approach. The Company has established a cybersecurity committee consisting of members of senior management, including the Company's Chief Information Security Officer ("CISO"). The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. The Company's CISO has over 25 years of information technology and cybersecurity experience. He holds the title of Senior Vice President of Technology Services and Chief Information Security Officer, has been in his role since 2021 and is supported by his direct reports and their teams. The cybersecurity committee also includes senior members from the Company's legal, human resources, technology, communications and risk management departments. This committee meets on a periodic basis to review various cybersecurity and data privacy matters and is responsible for maintaining processes to assess, identify and manage material risks from cybersecurity threats. The cybersecurity committee provides quarterly updates to the Company's General Counsel, Chief Financial Officer and Executive Vice President of Global Media Operations and Technology. In addition, the cybersecurity committee has established regional triage teams that are responsible for responding to any cybersecurity incident and deciding if other members of the cybersecurity committee, Company employees or Company vendors should be involved in the Company's response.


text: Our Audit Committee takes the lead on behalf of our Board of Directors in monitoring risk management, which includes overseeing the Company's management of its cybersecurity and data privacy. The Audit Committee meets on a quarterly basis with our General Counsel and Chief Financial Officer, who provide quarterly reports concerning the Company's information security and cybersecurity risks.


text: Although we have not been materially impacted by any cybersecurity incident to date, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "We face continually evolving cybersecurity risks, which could result in the disclosure, theft or destruction of confidential information, disruption of our programming, damage to our brands and reputation, legal exposure and financial losses."


text: All companies utilizing technology are subject to the risk of breaches of or unauthorized access to their computer systems. The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The Audit Committee of our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats and incidents. Our policies, processes and procedures include, among other things, annual external penetration testing using an experienced third-party company; a cybersecurity incident response and recovery plan; periodic and ongoing security awareness training for employees; the use of several comprehensive vulnerability analysis systems to evaluate software vulnerabilities both internally and externally; cryptography and encryption; data erasure and media disposal, regular data backups and restoration processes; and mechanisms to detect and monitor unusual network activity. The Company also requires that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment and provide contractual assurances relating to their security responsibilities, controls, reporting, and roles and responsibilities with regard to cybersecurity. We also maintain controls and procedures that are designed to promptly escalate certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board of Directors in a timely manner. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.


text: Although we have not been materially impacted by any cybersecurity incident to date, we have been and continue to be subject to cybersecurity threats in the normal course of our business, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "We face continually evolving cybersecurity and other technology-related risks, which could result in the disclosure, theft, destruction, or misappropriation of, or access to, confidential information, disruption of our programming, damage to our brands and reputation, legal exposure and financial losses."


text: • Cybersecurity incident means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein. • Cybersecurity threat means any potential unauthorized occurrence on or conducted through a registrant's information systems that may result in adverse effects on the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein. • Information systems means electronic information resources, owned, or used by the registrant, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the registrant's information to maintain or support the registrant's operations.

companyName: Arq, Inc.

ticker: ARQ


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We engage third parties in connection with our risk assessment processes. We require each third-party service provider to adhere to our internal security policies and certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. These service providers are primarily overseen by our Vice President of Information Technology ("VP of IT") and assist us in monitoring and testing our safeguards, including execution of external penetration testing and ongoing real time vulnerability assessments through our extended detection and response processes to identify cybersecurity threats. We conduct risk assessments in the event of a material change in our business processes that may affect information systems that are vulnerable to such cybersecurity threats through our normal change control processes. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and personnel, including our VP of IT, who reports to our VP of Finance, to manage the risk assessment and mitigation process.


text: As part of our overall risk management, we monitor and test our safeguards and train our employees on the importance of these safeguards. We maintain a formal information security awareness training program for all employees that includes training on matters such as phishing, email security best practices and data protection. Employees also receive random phishing tests at regular intervals to further assess and mitigate overall risk.


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents impacting the Company. The Response Plan includes (1) detection, (2) analysis, which may include timely notice to our management and audit committee chair, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. We also maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents. It is important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.


text: To date there have been no cybersecurity incidents that have materially affected the Company or its operations. Despite security measures we have implemented, there is always the risk that certain cybersecurity incidents could materially disrupt operational systems limiting our ability to manufacture and deliver products to customers.


text: Our VP of IT has approximately five years of experience in cybersecurity and oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our VP of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats, including monitoring and assessing strategic risk exposure.


text: While management is responsible for the day-to-day management of cybersecurity policies and procedures, our audit committee is tasked with oversight of our risk management process, which includes risks from cybersecurity threats. The processes by which our audit committee is informed about and monitors the Company's strategy regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following:


text: Our VP of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, emerging threats and updates, cybersecurity systems testing, activities of third parties, and the like. Our audit committee and VP of IT provide regular updates to the board of directors on such reports. In the event of an actual cybersecurity threat or incident, management is notified in accordance with the cybersecurity response plan above.


text: • Cybersecurity incident means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through the Company's information systems that jeopardizes the confidentiality, integrity, or availability of the Company's information systems or any information residing therein. • Cybersecurity threat means any potential unauthorized occurrence on or conducted through the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of the Company's information systems or any information residing therein. • Information systems means electronic information resources, owned, or used by the Company, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the Company's information to maintain or support the registrant's operations.


text: We engage third parties in connection with our risk assessment processes. We require each third-party service provider to adhere to our internal security policies and certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our systems. These service providers are primarily overseen by our Vice President of Information Technology ("VP of IT") and assist us in monitoring and testing our safeguards, including execution of external penetration testing and ongoing real time vulnerability assessments through our extended detection and response processes to identify cybersecurity threats. We conduct risk assessments in the event of a material change in our business processes that may affect information systems that are vulnerable to such cybersecurity threats through our normal change control processes. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and personnel, including our VP of IT, who reports to our Chief Accounting Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management program, we monitor and test our safeguards and train our employees on the importance of these safeguards. We maintain a formal information security awareness training program for all employees that includes training on matters such as phishing, email security best practices and data protection. Employees also receive random phishing tests at regular intervals to further assess and mitigate overall risk.


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents impacting the Company. The response plan includes (1) detection, (2) analysis, which may include timely notice to our management and audit committee chair, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. Annually, we execute a tabletop exercise to test our incident response plan documentation and process execution. We also maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents. It is important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.


text: Our VP of IT has more than six years of experience in cybersecurity and oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our VP of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats, including monitoring and assessing strategic risk exposure.


text: While management is responsible for the day-to-day management of cybersecurity policies and procedures, the audit committee of our Board is tasked with oversight of our risk management process, which includes risks from cybersecurity threats.


text: Our VP of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, emerging threats and updates, cybersecurity systems testing, activities of third parties, and the like. Our audit committee and VP of IT provide regular updates to the Board on such reports. In the event of an actual cybersecurity threat or incident, management and the audit committee are notified in accordance with the Company's cybersecurity response plan detailed above.


text: We face significant and persistent cybersecurity risks due primarily to: the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. We are committed to maintaining strong governance and oversight of these risks and to implementing mechanisms, controls, technologies and processes designed to help us assess, identify and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: KonaTel, Inc.

ticker: KTEL


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third parties. We have processes in place to assess, identify, manage and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program and abiding by information handling and asset management requirements. We have an escalation process in place to inform senior management and the Board of Directors of these material issues.


text: The Company is a shell company with no business operations. Our sole business activity has been to seek a merger with a suitable operating company.

companyName: Signature Holdings Corp


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board of Directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We consistently evaluate risks from potential cybersecurity threats, monitor our information systems for potential vulnerabilities and test these systems according to industry best practices. We have not encountered any cybersecurity incidents.


text: We face significant and persistent cybersecurity risks due primarily to (i) the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and (ii) our use of third-party products, services and components. We are committed to maintaining strong governance and oversight of these risks and to implementing mechanisms, controls, technologies and processes designed to help us assess, identify and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third parties. We have processes in place to assess, identify, manage and address material cybersecurity threats and incidents. These include, among other things: (i) annual and ongoing security awareness training for employees; (ii) mechanisms to detect and monitor unusual network activity; and (iii) containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program and abiding by information handling and asset management requirements. We have an escalation process in place to inform our senior management and our Board of Directors of these material issues.


text: We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program informed by and incorporating elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework. This program, which is integrated into our overall enterprise risk management strategy, is designed to identify, assess, and mitigate critical risks from cybersecurity threats. Our cybersecurity risk management program is overseen by our Chief Technology Officer and is supported by a third-party information technology vendor who, as appropriate, helps to assess our cybersecurity program against industry standards. Our cybersecurity program includes safeguards such as firewalls, DDoS mitigation tools, data encryption technologies, and authentication controls such as multi-factor authentication. We monitor our cybersecurity posture through periodic risk assessments and external audits, which are reviewed primarily by our Chief Technology Officers and others as needed and incorporated into our overall enterprise cyber strategy and risk management program. Additionally, we have adopted an incident response plan which has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.

companyName: Doximity, Inc.

ticker: DOCS


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as those that may have access to restricted systems and data, including through review of System and Organization Controls (SOC) reports prior to onboarding. As appropriate, we also include contractual requirements regarding cybersecurity practices in third-party contracts.


text: We have a security awareness training program, required for all employees and contractors upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, see "Risk Factors—Risks Related to Our Business—If our security measures are compromised now or in the future, or the security, confidentiality, integrity, or availability of our information technology, software, services, communications, or data is compromised, limited, or fails, this could have a material adverse effect on our business, financial condition, and results of operations."


text: Related to Cybersecurity Risks Our Chief Technology Officer is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. Our Chief Technology Officer has over 15 years of experience in software development and security architecture. Our Chief Technology Officer provides reports to and meets periodically with our General Counsel to discuss and review our information security and cybersecurity risk management processes.


text: Our Board of Directors has delegated oversight of the Company's enterprise risk management processes, including those related to cybersecurity risks, to the audit committee of the Board of Directors (the "Audit Committee"). Our General Counsel, following consultation with our Chief Technology Officer, provides updates to the Audit Committee concerning our cybersecurity program at its regular meetings, and the General Counsel and Chief Technology Officer provide a deeper review of the cybersecurity program, including information concerning areas of potential critical risk, to the Audit Committee approximately annually. The chair of the Audit Committee provides an overview of these updates to the Board following these sessions. In addition, the management team would escalate awareness of any material incidents to the Audit Committee promptly, should such an event occur.


text: Related to Cybersecurity Risks Our Chief Technology Officer, with over 15 years of experience in software development and security architecture, is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. Our Chief Technology Officer provides reports to and meets periodically with our General Counsel to discuss and review our information security and cybersecurity risk management processes.


text: Our board of directors has delegated oversight of the Company's enterprise risk management processes, including those related to cybersecurity risks, to the audit committee of the board of directors (the "Audit Committee"). Our General Counsel, following consultation with our Chief Technology Officer, provides updates to the Audit Committee concerning our cybersecurity program at its regular meetings, and the General Counsel and Chief Technology Officer provide a deeper review of the cybersecurity program, including information concerning areas of potential critical risk, to the Audit Committee approximately annually. The chair of the Audit Committee provides an overview of these updates to the Board following these sessions. In addition, the management team would escalate awareness of any material incidents to the Audit Committee promptly, should such an event occur.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, in conjunction with the Company's enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology ("IT") environment including systems, hardware, software, data, people, and processes.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: The underlying processes and controls of our cyber risk management program are designed based on standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Skye has an annual assessment performed by a third-party specialist of its cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes significant cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists develop a risk mitigation plan to address identified risks and, where necessary, remediate potential issues identified through the annual assessment process.


text: In addition, we maintain an information security policy that covers safeguarding and managing confidential information, handling personal and company-sensitive data, managing access on/off-boarding and user accounts, acceptable use and IT change management to help govern the processes put in place by management designed to protect Skye's IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We and our cybersecurity partners maintain an IT assets inventory, identity access management controls including restricted access of privileged accounts, physical security measures at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and data traffic monitoring and automated alerting, capacity management, industry-standard encryption protocols, formalized change management processes, critical data backups infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.


text: Our management team is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team has experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Skye for strategic cyber risk management, advisory and decision making.


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical IT service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes processes for performing due diligence upon on-boarding.


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of our corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the our service delivery; however, potential vulnerabilities to known or unknown threats will still remain and we may not be able to prevent security incidents in the future. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: The audit committee (the " Audit Committee ") of our Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board at least annually, as part of our corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the service delivery; however, potential vulnerabilities to known or unknown threats will still remain and we may not be able to prevent security incidents in the future. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: As part of our cybersecurity process, we engage external auditors and consultants to assess our cybersecurity program and compliance with applicable practices and standards. To identify and manage the material risks of cybersecurity threats to our business, operations and control environments, we have made significant investments in our technology and have implemented policies, programs and controls, with a focus on cybersecurity incident prevention and mitigation. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed by third-party auditors and consultants, as well as our internal Information Technology and Legal teams, to ensure compliance with applicable practices and standards.

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: We mitigate risks from cybersecurity incidents using a multi-faceted approach that includes, but is not limited to: establishing information security policies and standards, implementing information protection processes and technologies, assessing cybersecurity risk through vulnerability assessments and audits on an annual basis, reviewing newly developed cybersecurity standards or legislation, implementing cybersecurity training, monitoring our information technology systems for cybersecurity threats and collaborating with public and private organizations on best practices..


text: We did not experience a material cybersecurity incident during the fiscal year ended December 29, 2023. For more information on risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see "Information technology system failures, cybersecurity incidents or other disruptions to our use of technology and networks could interrupt our operations and adversely affect our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our board of directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, including the Company's risk profile and exposures as they relate to cybersecurity, conducting reviews of policies regarding risk assessment and risk management and major risk exposures, as well as evaluations of risks from potential or actual cybersecurity threats. Our Chief Information Officer, Vice President of Infrastructure, and Security Administrator have responsibility of cybersecurity oversight of the Company and each have 12, 15, and 6 years of cybersecurity experience, respectively. The Security Administrator reports to the Vice President of Infrastructure, who in turn reports to the Chief Information Officer. Members of the Board receive regular quarterly cybersecurity updates from our Chief Information Officer, including updates on existing and new cybersecurity risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.


text: We mitigate risks from cybersecurity incidents using a multi-faceted approach that includes, but is not limited to: establishing information security policies and standards, implementing information protection processes and technologies, assessing cybersecurity risk through vulnerability assessments and audits on an annual basis, reviewing newly developed cybersecurity standards or legislation, implementing cybersecurity training, monitoring our information technology systems for cybersecurity threats and collaborating with public and private organizations on best practices.


text: We did not experience a material cybersecurity incident during the fiscal year ended December 27, 2024. For more information on risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see "Information technology system failures, cybersecurity incidents or other disruptions to our use of technology and networks could interrupt our operations and adversely affect our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our board of directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, including the Company's risk profile and exposures as they relate to cybersecurity, conducting reviews of policies regarding risk assessment and risk management and major risk exposures, as well as evaluations of risks from potential or actual cybersecurity threats. Our Chief Information Officer, Vice President of Infrastructure, and Security Administrator have responsibility of cybersecurity oversight of the Company and each have 13, 16, and 7 years of cybersecurity experience, respectively. The Security Administrator reports to the Vice President of Infrastructure, who in turn reports to the Chief Information Officer. Members of the Board receive regular quarterly cybersecurity updates from our Chief Information Officer, including updates on existing and new cybersecurity risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.


text: Information Security Program Our processes for assessing, identifying and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K, are integrated into our overall risk management strategy. We regularly assess the risks inherent in operating our business as well as the effectiveness of our risk management activities. The Artisan Risk and Integrity Committee, which includes members of the Company's senior leadership team including senior representation from the firm's operations, distribution, finance, internal audit, investment strategy and legal functions, facilitates our annual enterprise risk assessment process, which uses a top-down approach to identify and prioritize key risks to achieving our purpose and maintaining our business model. We also conduct a bottom-up information and cybersecurity risk assessment on an annual basis, which focuses on the evolving threat landscape, changes in the firm's operations, changes in regulatory requirements and security incidents. This risk assessment informs the Company's information security awareness training and testing and assessment program.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: We manage risk, including cybersecurity risk, via three distinct lines of defense. As the first line of defense, business managers, including IT managers, are responsible for maintaining effective internal controls and executing risk and control procedures on a day-to-day basis. As the second line of defense, the legal, compliance and information security governance functions provide guidance and training, as well as perform monitoring, testing and surveillance activities relating to compliance with the firm's policies and procedures, applicable laws and regulations, contractual requirements, ethical standards and industry best practices. As the third line of defense, our internal audit team provides periodic and independent assurance that the firm's internal controls are implemented and operating effectively.


text: With respect to cybersecurity risk, we have a dedicated security engineering and operations team, supplemented with security consultants and two managed security service providers, that performs first line responsibilities by identifying security risks, deciding if and how to implement security tools and controls, and implementing and maintaining those tools and controls. This team is led by our Director of Technical Services, who has 32 years of information technology experience, and reports to our Chief Information Officer (CIO), who has 40 years of information technology experience. We also have an information security governance team that is responsible for performing second line responsibilities, including training associates, providing advice to our associates in carrying out their responsibilities consistent with the goals of the security program, assessing whether the program is reasonably designed and operating effectively, and responding to and reporting to stakeholders on the reasonableness and effectiveness of the security program. The information security governance team is led by our Chief Information Security Officer (CISO), who is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) and has 37 years of experience in the field of cybersecurity. Our CISO reports directly to our Chief Legal Officer and General Counsel. Together, these teams maintain a robust information security program that utilizes a multi-layered defense-in-depth strategy and is designed to prevent, detect, mitigate and remediate cybersecurity incidents.


text: Our information security program is subject to periodic internal audits and independent third-party reviews. We use third party security firms for security consulting, including configuration reviews and assessments, as well as performing periodic (no less frequently than annual) penetration tests to evaluate the integrity of our systems. We also conduct monitoring and testing activities, such as phishing simulations.


text: Our associates receive annual, mandatory information security training, which includes information regarding specific policies and procedures and education on risks such as phishing attacks, social engineering, password management and privacy. New associates receive cybersecurity training as part of their orientation process.


text: To date, we have not experienced any known material cybersecurity breach or threat that resulted in or is reasonably likely to result in any material loss, or any material impact on our business strategy, results of operations or financial condition.


text: Oversight of Third-Party Service Providers We engage many service providers in connection with our business operations. Some of these service providers play a minor role, while others perform services that are critical to our operations. We have a service provider oversight committee that oversees and facilitates the management of third-party relationships that are integral to our investment management activities. The committee maintains a written policy and other guidance that set forth our approach to managing and providing oversight of those third-party service providers in a manner consistent with the level of risk and complexity of the services provided. Our approach to oversight, which includes considerations regarding selection, initial and ongoing due diligence, contracting, ongoing monitoring and oversight and compliance with applicable regulatory and service level expectations, is tailored to each such service provider based on the scope of the services provided. Security assessments of those service providers may include questionnaires, meetings and onsite visits. We also consider contingency plans in the event a key service provider is not able to provide its respective services.


text: In addition, our internal audit team periodically tests the firm's management and oversight of certain key third-party service providers, including those overseen by the service provider oversight committee, as well as third parties that support financial reporting.


text: Role of Management Management is responsible for the assessment and management of risk, including cybersecurity risk. The Artisan Risk and Integrity Committee facilitates the annual enterprise risk assessment that identifies and prioritizes the Company's key risks, including cybersecurity risk. The information security governance team also reports to members of senior management the results of its annual cybersecurity risk assessment.


text: Cybersecurity risks are managed by and through our information security program, which consists of the activities of teams managed by our CIO (first line of defense) and CISO (second line of defense). In the normal course of business, executive management is informed about the prevention, detection, mitigation and remediation of cybersecurity risks through these established reporting lines and through its oversight of the information security program.


text: Outside of the normal course of business, in the event a cybersecurity incident occurs, our incident response plan provides guidance in assessing and responding to the incident. The incident response plan establishes mechanisms by which we determine the scope of and potential damage caused by the incident and determine and execute the appropriate response. The plan outlines roles and responsibilities and sets forth escalation points to ensure that appropriate individuals and groups are notified and provided relevant information depending on the type and severity of the incident. Cybersecurity incidents are reported to each of the Company's Chief Legal Officer, Chief Administrative Officer, and the Chair of the Artisan Risk and Integrity Committee, who oversee the investigation and remain apprised of information regarding the remediation of the incident. This group, based on its assessment of the incident's potential impact to the Company and its stakeholders, will also make determinations regarding further escalation of the incident to the full senior leadership team. The senior leadership team is kept informed of the investigation and is responsible for making certain decisions throughout the course of the investigation, including whether it is appropriate to report the incident to the Board prior to its next meeting.


text: Role of the Board of Directors Our Board is responsible for overseeing management in the execution of its risk management responsibilities, including with respect to cybersecurity risk management. In addition, an overall review of risk is inherent in the Board's ongoing oversight of our business, long-term strategies and other matters presented to our Board. Our Board exercises its risk oversight responsibilities periodically as part of actions taken and matters reviewed during its meetings and also through the activities of its standing committees. The Board has delegated responsibility for cybersecurity risk oversight to the Audit Committee.


text: The Audit Committee oversees cybersecurity risk management through the periodic reports it receives from management. On a quarterly basis, management reports on any significant cybersecurity events and trends impacting the Company. Annually, our CIO and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program. The Audit Committee also reviews the Company's cybersecurity insurance program on an annual basis in connection with the program's renewal and receives periodic reports from our Director of Internal Audit regarding internal audits of our information security program.


text: Information Security Program Our processes for assessing, identifying and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K, are integrated into our overall risk management strategy. We regularly assess the risks inherent in operating our business as well as the effectiveness of our risk management activities. The Artisan Risk and Integrity Committee, which includes members of the Company's senior leadership team including senior representation from the firm's operations, distribution, finance, internal audit, investment strategy and legal functions, facilitates our annual enterprise risk assessment process, which identifies and prioritizes key risks to achieving our purpose and maintaining our business model. We also conduct a bottom-up information and cybersecurity risk assessment on an annual basis, which focuses on the evolving threat landscape, changes in the firm's operations, changes in regulatory requirements and security incidents. This risk assessment informs the Company's information security awareness training and testing and assessment program.


text: We manage risk, including cybersecurity risk, via three distinct lines of defense. As the first line of defense, business managers, including IT managers, are responsible for maintaining effective internal controls and executing risk and control procedures on a day-to-day basis. As the second line of defense, the legal, compliance and information security governance functions provide guidance and training and perform monitoring, testing and surveillance activities relating to compliance with the firm's policies and procedures, applicable laws and regulations, contractual requirements, ethical standards and industry best practices. As the third line of defense, our internal audit team provides periodic independent assurance that the firm's internal controls are implemented and operating effectively.


text: With respect to cybersecurity risk, we have a dedicated security engineering and operations team, supplemented with security consultants and two managed security service providers, that performs first line responsibilities by identifying security risks, deciding if and how to implement security tools and controls, and implementing and maintaining those tools and controls. This team is led by our Director of Technical Services, who has over 30 years of information technology experience, and reports to our Chief Information Officer (CIO), who has over 40 years of information technology experience. We also have an information security governance team that is responsible for performing second line responsibilities, including training associates, providing advice to our associates in carrying out their responsibilities consistent with the goals of the security program, assessing whether the program is reasonably designed and operating effectively, and responding to and reporting to stakeholders on the reasonableness and effectiveness of the security program. The information security governance team is led by our Chief Information Security Officer (CISO), who is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) and has almost 40 years of experience in the field of cybersecurity. Our CISO reports directly to our Chief Legal Officer and General Counsel. Together, these teams maintain a robust information security program that utilizes a multi-layered defense-in-depth strategy and is designed to prevent, detect, mitigate and remediate cybersecurity incidents.


text: Our information security program is subject to periodic internal audits and independent third-party reviews. We use third party security firms for security consulting, including configuration reviews and assessments, as well as performing periodic (no less frequently than annual) penetration tests to evaluate the integrity of our systems. We also conduct internal monitoring and testing activities, such as phishing simulations.


text: Our associates receive annual, mandatory information security training, which includes information regarding specific policies and procedures and education on cyber risks such as phishing attacks, social engineering, password management and privacy. New associates receive cybersecurity training as part of their orientation process.


text: Cybersecurity risks are managed by and through our information security program, which consists of the activities of teams managed by our CIO (first line of defense) and CISO (second line of defense). In the normal course of business, executive management is informed about the prevention, detection, mitigation and remediation of cybersecurity risks through the established reporting lines of the CIO and CISO and through its oversight of the information security program.


text: In the event a cybersecurity incident occurs, our incident response plan provides guidance in assessing and responding to the incident. The incident response plan establishes mechanisms by which we determine the scope of and potential damage caused by the incident and determine and execute the appropriate response. The plan outlines roles and responsibilities and sets forth escalation points to ensure that appropriate individuals and groups are notified and provided relevant information depending on the type and severity of the incident. Cybersecurity incidents are reported to each of the Company's Chief Legal Officer, Chief Administrative Officer, Chief Operating Officer and the Chair of the Artisan Risk and Integrity Committee, who oversee the investigation and remain apprised of information regarding the remediation of the incident. This group, based on its assessment of the incident's potential impact to the Company and its stakeholders, will also make determinations regarding further escalation of the incident to the full senior leadership team. The senior leadership team is kept informed of the investigation and is responsible for making certain decisions throughout the course of the investigation, including whether it is appropriate to report the incident to the Board prior to its next meeting.


text: The Audit Committee oversees cybersecurity risk management through the periodic reports it receives from management. On a quarterly basis, management reports on any significant cybersecurity events or trends impacting the Company. Annually, our CIO, Director of Technical Services and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program. The Audit Committee also reviews the Company's cybersecurity insurance program on an annual basis in connection with the program's renewal and receives periodic reports from our Director of Internal Audit regarding internal audits of our information security program.


text: As a cloud service provider, Sprout Social believes keeping data secure is important and takes steps designed to do so.

companyName: Sprout Social, Inc.

ticker: SPT


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical infrastructure, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our employees and customers ("Information Systems and Data").


text: Sprout Social maintains an overarching security program comprised of several teams including (1) Security Operations, (2) Information Technology, (3) Application Security, (4) Infrastructure Security, and (5) Governance, Risk, and Compliance. Together, these teams help identify, assess and manage the Company's cybersecurity threats and risks using various methods including, for example, internal and external audits, automated and manual tools, threat assessments for internal and external threats, software and services that identify cybersecurity threats, third party threat assessments, a vulnerability management policy and program, incident response exercises, and, evaluating threats reported to us through an external bug bounty program.


text: Our security program is designed to align with the ISO 27001 (International Organization for Standardization) standard, incorporates elements from the National Institute of Standards and Technology (NIST), and is regularly reviewed and audited by independent external third-party auditors. Depending on the environment, as part of our security program, we have implemented and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a general information security policy, incident response plan and incident response policy, data classification, protection, retention, and destruction policy, server protection and logging standards, vulnerability management program, vendor selection and security standard, business continuity and disaster recovery plan, employee onboarding, offboarding, and access escalation policy, risk management and audit policy, regular penetration testing of certain networks, maintaining industry recognized certifications, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register. Also, the security team works with management to identify, discuss, and prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, we use third-party service providers to assist us from time to time in reviewing our policies, standards and procedures, identifying and assessing material risks from cybersecurity threats, and making recommendations to improve our security program including for example professional services firms, external legal counsel, penetration testing firms, cybersecurity consultants, and cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and other types of third-party service providers for critical business operations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section of our risk factors titled, "Risks Related to the Use of Technology."


text: Our overarching security program, enterprise-wide cybersecurity strategy, risk management program, and related security policies, standards, and processes are managed by the Vice President of Information Technology, Security, and Compliance and the Chief Technology Officer. They are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's business strategy, communicating key priorities to relevant personnel, approving budgets, preparing for cybersecurity incidents, approving cybersecurity policies, and reviewing internal and external security assessments and other security-related reports. They also report on our risk management program, overall security posture, progress on maturing the security program, and new or emerging risks to senior management and the Board of Directors as applicable and on a regular basis.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management based on predefined criteria, including, for example, to our Vice President of Information Technology, Security, and Compliance, General Counsel, and CTO. Senior managers work with the Company's incident response team to help the Company mitigate and remediate certain cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Board of Directors, regulators, and law enforcement for certain cybersecurity incidents.


text: We implement and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical infrastructure, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our employees and customers ("Information Systems and Data").


text: Sprout Social maintains an overarching security program comprising several teams including (1) Security Operations, (2) Information Technology, (3) Application Security, (4) Infrastructure Security, and (5) Governance, Risk, and Compliance. Together, these teams help identify, assess and manage the Company's cybersecurity threats and risks using various methods including, for example, internal and external audits, automated and manual tools, threat assessments for internal and external threats, software and services that identify cybersecurity threats, third party threat assessments, a vulnerability management policy and program, incident response exercises, and evaluating threats reported to us through an external bug bounty program.


text: Our security program is designed to align with the ISO 27001 (International Organization for Standardization) standard, incorporates elements from the National Institute of Standards and Technology (NIST), and is regularly reviewed and audited by independent external third-party auditors. Depending on the environment, as part of our security program, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a general information security policy, incident response plan and incident response policy, data classification, protection, retention, and destruction policy, server protection and logging standards, vulnerability management program, vendor selection and security standard, business continuity and disaster recovery plan, employee onboarding, offboarding, and access escalation policy, risk management and audit policy, regular penetration testing of certain networks, maintaining industry recognized certifications, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register. Also, the security team works with management to help identify, discuss, and prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, we use third-party service providers to assist us from time to time in reviewing our policies, standards and procedures, identifying and assessing material risks from cybersecurity threats, and making recommendations to improve our security program, including, for example, professional services firms, external legal counsel, penetration testing firms, cybersecurity consultants, and cybersecurity software providers.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the sections of our risk factors titled "Risks Related to the Use of Technology" and "Legal and Regulatory Risks."


text: Our overarching security program, enterprise-wide cybersecurity strategy, risk management program, and related security policies, standards, and processes are managed by the Vice President of Information Technology, Security, and Compliance and the Chief Technology Officer. They are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's business strategy, communicating key priorities to relevant personnel, approving budgets, preparing for cybersecurity incidents, approving cybersecurity policies, and reviewing internal and external security assessments and other security-related reports. They also report on our risk management program, overall security posture, progress on maturing the security program, and new or emerging risks to senior management and the Board of Directors.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, trade secrets, personal information, and data of our customers (including their end-users) ("Information Systems and Data").

companyName: Fastly, Inc.

ticker: FSLY


text: Our Chief Information Security Officer ("CISO") and security organization help identify, assess, and manage the Company's cybersecurity threats and risks, including through the use of the Company's security risk register. The CISO and security organization identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: (1) identifying vulnerabilities through automated scans, vulnerability assessments, and subscriptions to threat intelligence feeds and notices; (2) assessing security weaknesses identified through internal security reviews, external penetration tests, and reports on our products and services; and (3) assessing the Company's threat landscape given the industry's risk profile, the results of our enterprise risk assessment, and information technology, privacy, and security audits.