text: The Board has ultimate oversight responsibility for the Company's risk management and recognizes the importance of protecting the data provided by the Company's customers and employees and devotes considerable time and attention to overseeing the strategies the Company employs to protect our data and systems and to mitigate against cybersecurity risk. A cybersecurity expert chairs the Risk Committee and provides technology-related insight and guidance to the Company. As part of the Risk Committee's responsibility for monitoring key business and regulatory risks, the Risk Committee receives from both our Chief Information Officer and CISO quarterly reports and materials which include a review of cybersecurity and information technology key risk indicators, test results and related remediation, and any recent cybersecurity threats or incidents and how the Company is managing those threats or incidents. The Risk Committee also periodically reviews reports on the threat environment, vulnerability assessments, results of penetration testing, and potential cybersecurity and data privacy incidents, as well as information on ongoing employee training relating to data privacy and cybersecurity and how to protect data against cyber threats. Further, on a quarterly basis, our CRO presents to the Risk Committee updates from our Director of Enterprise and Operational Management on the Company's business continuity program, which covers, among other things, outages and incidences and disaster recovery and business continuity testing. The Risk Committee also approves the annual risk assessment required by the Gramm-Leach-Bliley Act. Moreover, the CISO follows a risk-based escalation process to notify the Risk Committee outside of the cycle of regular updates when management has identified an emerging risk or material issue related to cybersecurity. The Risk Committee also reports material cybersecurity risks to the full Board, based on our CISO's assessment of risk. In addition, the Audit Committee reviews reports of the Company's internal audit department's periodic audits of our information security area and various components thereof.


text: We face a number of cybersecurity risks in connection with our business and we have, from time to time, experienced threats to and incidents involving our data and systems. For more information about the cybersecurity risks we face, see the risk factors captioned "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability " and " We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), adversely affect our business or reputation, and create significant legal and financial exposure. " In Item 1A- Risk Factors.

companyName: SouthState Bank Corp

ticker: SSB

secItem: Item 1C


text: We have strategically integrated cybersecurity risk management into our broader enterprise risk management function to promote a company-wide culture of cybersecurity risk management. Our board of directors has general oversight responsibility for our enterprise risk management function, which includes specific areas of focus including competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, compliance, information technology security programs (including cybersecurity), ESG/corporate social responsibility, political and reputational risks. Our board of directors has delegated oversight of certain of these areas to the committees of our board of directors, including delegating the oversight of our information technology security programs (including cybersecurity) to the risk committee of our board of directors (the " Risk Committee "). We believe this division of risk management-related roles to the committees of our board of directors fosters an atmosphere of significant involvement in the oversight of risk at the board level and complements our risk management policies. The oversight responsibility of our board of directors is facilitated by a management report process that is designed to provide both visibility and transparency to our board of directors about the identification, assessment and management of critical risks and management's risk mitigation strategies.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Our risk management team, which includes members of senior management, including our Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and General Counsel, as well as external consultants, works closely with our information technology department ("IT Department") to continuously evaluate and address cybersecurity risks relevant to our business and operations. In addition, we have set company-wide policies and procedures that directly or indirectly relate to cybersecurity matters, such as policies related to encryption standards, antivirus protection, access removal, multifactor authentication, confidential information or use of the internet, social media, email and wireless devices. These policies go through an annual internal management review and approval process.


text: Our CIO and our Vice President of IT ("VP of IT") are primarily responsible for our overall information security, strategy, policy, security engineering, operations and cybersecurity threat detection and the management of cybersecurity risks. Our CIO and VP of IT, collectively, have over fifty years of experience working in the information technology and cybersecurity field and have extensive experience assessing and managing cybersecurity and information technology programs and cybersecurity risk. Our CIO and VP of IT hold degrees in the information technology and cybersecurity fields, as well as hold certain cybersecurity and other relevant technology certifications. The CIO meets with our Chief Executive Officer ("CEO"), on a weekly basis, and the CFO, on a monthly basis, to discuss all relevant business risks, including cybersecurity risks and threats. In addition to regular reports from our CIO and vice president of internal audit regarding our program for managing our information security risks, including data privacy and protection risks we face, the CIO and VP of IT also meet quarterly with the Risk Committee to inform them of current cybersecurity risks and threats, as well as cybersecurity enhancement projects. Our full board of directors receives an annual update regarding the current cybersecurity environment from our CIO, which may include presentations from external consultants. Our Enterprise Risk Management ("ERM") committee, which includes several members of senior management, including our CFO, our CIO, and a Certified Information Systems Auditor, also presents all of our top organizational and operational risks, including information security-related risks, focus areas and accomplishments throughout our various businesses, to the Risk Committee on a quarterly basis.


text: Our IT Department management team meets monthly to assess and review cybersecurity status, which includes dashboard reviews, operational risks and company compliance. Annually, our internal audit group and third-party consultants meet with our IT Department to perform risk assessment walkthrough meetings, discuss potential enhancements, materiality of risks and alignment with the Center for Internet Security Critical Security Controls framework. In addition, we engage third-party consultants to perform annual red team exercises and external penetration tests.


text: We promote a culture of cybersecurity compliance throughout our organization, including required monthly cybersecurity training for all employees with company accounts and annual training for service-related employees on cybersecurity related topics, including social engineering (e.g., phishing, vishing and smishing), ransomware, denial of service or information, and other security breach tactics. We conduct quarterly ERM discussions where top risk owners discuss how risks have changed and how such risks are being addressed with approaches designed to mitigate such risks. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers. We perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers, which includes our internal assessment of complementary user entity controls. All other material third-party service providers undergo assessment as a contract is entered into or renewed to ensure cybersecurity alignment. Our internal audit group meets regularly with management team members of Marriott, our third-party hotel manager, to assess security applications compliance. We also regularly meet with management team members of Marriott to understand system upgrades, changes and associated risks with third-party managed applications. In addition, we generally require our third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: In assessing cybersecurity threats, our IT Department has established controls and procedures for responding to cybersecurity incidents, including a process to evaluate the significance of a cybersecurity incident. Members of senior management, including our General Counsel and CFO, are tasked with performing a materiality assessment in the event of a cybersecurity incident, which includes the consideration of relevant quantitative and qualitative factors, as well as SEC guidance. Based on the results of this evaluation, further escalation of the cybersecurity event may occur, which may include our CEO, our board of directors and/or law enforcement. In addition, members of senior management will determine, based on the assessment described above, whether the cybersecurity incident requires disclosure with the SEC.


text: We currently maintain a cybersecurity insurance policy that provides coverage for security incidents and periodically meet with our insurer to discuss emerging trends in cybersecurity. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, notwithstanding the programs, policies and procedures described above, there can be no assurance that we or businesses with which we interact will not experience a cybersecurity incident that materially affects us in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, including the failure to protect the integrity or availability of IT systems or the security of confidential information, or the introduction of malware or ransomware, could harm our business." in Item 1A. Risk Factors of Part I of this Annual Report on Form 10-K.


text: Due to our structure as a REIT, the cybersecurity program, processes, and strategy described in this section are limited to the corporate systems, service providers, and information services belonging to or supporting the REIT. In order to maintain REIT status, the Company does not operate or manage its hotels. We lease each of our hotels to the TRS Lessee or one of its subsidiaries, which engages with third-party eligible management companies to operate and manage all aspects of the properties; and those third-party managers, in turn, rely on systems that they manage directly or indirectly (through their own service providers), including but not limited to reservation systems, billing, building and property management systems, point-of-sale systems, and financial transactions and records that store and process proprietary or personal information. In light of this structure, we do not have actual or contractual access to the systems or information maintained by the third-party managers, and we must instead rely on such managers' programs and processes to protect the properties in which we invest from risks associated with cybersecurity threats.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.


text: Our program is informed by the International Standards Organization ("ISO") 27000, ISO 27001, and National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27000, ISO 27001 and NIST CSF as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program are integrated into our overall enterprise risk management program, and share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: an information technology department principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees and senior management; and business continuity, contingency, and recovery plans, including a cybersecurity incident response plan with procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with, or effective in protecting our systems and information.


text: Our board of directors (the "board") considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee (the "committee") oversight of cybersecurity and other information technology risks. The committee oversees management's implementation of our cybersecurity risk management program.


text: The committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the committee, as necessary, regarding any significant cybersecurity incidents.


text: The committee reports to the board regarding its activities, including those related to cybersecurity. The board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management as part of the board's continuing education on topics that impact public companies.


text: Our management team, including our chief financial officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel, our external information technology support, and our retained external cybersecurity consultants. Our information technology department has over 20 years of experience developing and implementing computer infrastructure, including cybersecurity and audit compliance. We seek to use the latest security technologies from leading vendors to help secure our network and to regularly monitor and assess alerts and threat levels. The information technology department possesses various industry certifications and continuously refreshes skills through relevant training.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risks from cybersecurity threats or incidents (cybersecurity risks) are assessed, identified and managed by the Company in a manner that is consistent with leading cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST Framework). The Company's approach to cybersecurity risk management is generally based on the six core functions contained within the NIST Framework organizing structure: identify, protect, detect, respond, recover and govern.

companyName: RLI CORP

ticker: RLI


text: As of the date of this report, risks from cybersecurity threats or incidents have not materially affected, nor are they reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. However, in light of emerging and changing cybersecurity threats and vulnerabilities, the Company cannot guarantee that it will not be a victim of a cybersecurity attack in the future that could materially affect the Company. See Item 1A, Risk Factors for more information.


text: The IT security department is responsible for the day-to-day assessment and management of cybersecurity risks, including efforts to prevent and, if necessary, mitigate the effects of a cybersecurity incident. The Company's IT security department operates under general oversight of the Company's chief information officer (CIO), who also serves as the Company's chief information security officer (CISO). The Company's CIO has 27 years of technology and technology leadership experience, including 14 years serving as a CISO, in the insurance industry. The head of the Company's IT security department, who reports to the CIO, holds a Certified Information Systems Security Professional designation from the Information Security Certification Consortium, has 20 years of experience in the insurance industry and has served in IT security-related roles for 24 years.


text: Management oversight of cybersecurity risks is provided primarily through the Company's Technology Committee, which is chaired by the Company's CIO and comprised of members of senior management. The Technology Committee's responsibilities include general oversight of cybersecurity-related matters, maintenance of the cybersecurity and data privacy programs and oversight of the Company's cybersecurity incident response plan. Technology risk, including cybersecurity risk, is also integrated into the Company's enterprise risk management process. The Company's Risk Committee, chaired by the CEO and comprised of members of executive management, identifies the Company's material risks and reviews the strategies, processes and controls in place to facilitate the understanding, identification, prevention, measurement, reporting and mitigation of those risks. The Risk Committee meets quarterly and reviews the Technology Committee's current assessment of cybersecurity risks.


text: Through 2024, the RLI Corp. Board of Directors provided oversight for cybersecurity risks primarily through its Audit Committee. In February 2025, the charter of the Finance & Investments Committee was revised to include overall enterprise risk management oversight, including oversight of cybersecurity risk. The committee was renamed the Finance & Risk Committee (FRC). The Company's CIO, along with the head of the Company's IT security department, presents quarterly to the designated committee on cybersecurity risks and the Company's strategies to assess and manage those risks. Additionally, the board receives periodic updates on emerging cybersecurity issues and developments through director education provided by the Company and third-party experts, detailed reviews provided by the CIO and the Company's head of IT security on select cybersecurity topics, and periodic "table top" simulations of a cybersecurity event.


text: The Company maintains a Cybersecurity Incident Response Plan (CIRP) providing a framework for identifying, evaluating and escalating potential or actual cybersecurity events. The CIRP assigns responsibilities and provides a workflow between the Company's IT security department; the Company's Technology Committee; and the board of directors regarding the detection, assessment and response to a cybersecurity event.


text: The Company's internal audit department routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other third-party consultants in a number of areas to support the assessment, identification and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, training and incident response, among others. The Company performs cybersecurity due diligence and monitoring of third-party vendors, which may include the review of System and Organization Control (SOC) reports or the results of a security questionnaire, to identify the cybersecurity controls and protections maintained by a third party.


text: Our Board of Directors oversees our risk management process, including risks from cybersecurity threats. Our Board of Directors reviews strategic risk exposure, and members of our management are responsible for addressing the material risks we face on a day-to-day basis. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole as well as through our Audit Committee. Our Board and our Audit Committee receive updates annually and more frequently as deemed necessary from our management on cybersecurity.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Our Chief Financial Officer, our Internal Audit Director and our external Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Manager of our Information Technology department has 36 years of experience in the design, implementation, and support of information technology infrastructures with significant expertise in information technology forensics. He is assisted by two network engineers with 27 years of information technology experience with a focus on information technology forensics.


text: Network and information systems and other technologies play an important role in our business activities. We also obtain certain confidential, proprietary and personal information about our charterers, personnel, and vendors. To protect our data, we have employed cybersecurity protocols which are designed to work in tandem with internal controls to safeguard our information technology environment. Our information technology infrastructure is designed with commercial flexibility, data integrity, and safety in mind. We utilize a layered approach of systems and policies intended to provide a secure operating environment and promote business continuity. Our hardware and software systems are equipped with technology intended to offer access and intrusion protection, software and communications systems protections, and mitigate cybersecurity threats.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information maintained in them.


text: We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, an outside consulting firm conducts a National Institute of Standards and Technology and International Organization for Standardization based cybersecurity capability maturity assessment every two years, which is reviewed with our Chief Financial Officer. We also perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold quarterly online cybersecurity trainings for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: The Company also maintains a cyber liability insurance policy. See Item 1 – "Business – Insurance – Cyber Liability Insurance" in this report.


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability" and Item 1, "Business – Environmental and Other Regulations – Safety Management System Requirements" in this report.


text: In the ordinary course of our business, we collect, use, store, and transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our IT systems is important to our operations and business strategy. We understand the growing challenges associated with cybersecurity threats and have established a strong cybersecurity program intended to continue to monitor and improve our cybersecurity posture.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Risk Management Approach We have documented cybersecurity policies and standards, and we assess risks from cybersecurity threats and monitor information systems for potential cybersecurity issues. These processes are managed and monitored by a dedicated cybersecurity team, including third-party service providers, and led by our Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to help prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and help maintain a stable information technology environment. For example, we use processes, tools and external services to conduct regular vulnerability testing, penetration testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers.


text: We work to maintain a strong cybersecurity posture through a multi-layered approach. Our endpoint detection and response ("EDR") system helps monitor and analyze endpoint devices, and is designed to assist us in quickly identifying and responding to emerging threats. Complementing our EDR capabilities, our managed detection and response service assists with threat monitoring, proactive threat hunting, and rapid incident response. Furthermore, we employ data loss prevention tools to help enforce strict data security policies, prevent unauthorized access and protect the transmission of sensitive information. These integrated technologies help us to detect, mitigate, and respond to cyber threats, with the goal of minimizing potential disruptions to our business operations.


text: We have an incident response plan designed to help quickly detect, contain and remediate cybersecurity incidents. This plan outlines clear escalation procedures, roles and responsibilities to help us respond in a timely manner to potential threats. We also conduct regular employee training on matters such as phishing and email security best practices, among other topics. In addition, we consult with outside advisors and experts when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to help anticipate future threats and trends, and their impact on our risk environment.


text: Our current Head of IT reports directly to our Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity matters, holds a Master of Science degree in Telecommunications and Computer Networks and is Project Management Professional, Certified Scrum Master and IT Infrastructure Library certified. We have established a cybersecurity council, facilitated by the Head of IT, which includes senior leadership from various departments. The council meets quarterly to review cybersecurity strategies, assess emerging threats, and receive updates on regulatory and industry best practices.


text: Our Board as a whole has oversight for the most significant risks facing us and for our processes to help identify, prioritize, assess, manage, and mitigate those risks, including oversight of cybersecurity risks. Our Board receives at least two updates each year on cybersecurity and information technology matters and related risk exposures from our Head of IT as well as other members of our senior leadership team.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have identified and mitigated certain known cybersecurity threats, which we determined are not reasonably likely to materially affect us and have strengthened our cybersecurity ecosystem. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - Significant disruptions of information technology systems or cybersecurity incidents could adversely affect our business."


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our tenant and vendor relationships, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on a multidisciplinary team, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, and conducting threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, systems monitoring, employee training, and penetration testing.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "The occurrence of cyber incidents or cyberattacks could disrupt our operations, result in the loss of confidential information and/or damage our business relationships and reputation," for additional discussion about cybersecurity-related risks.


text: Our board of directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The audit committee of the board of directors oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The audit committee engages in regular discussions with management regarding our significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.


text: Our management, represented by our Chief Operating Officer, Catherine Hastings, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Ms. Hastings is an experienced risk management professional, having previously served as our Chief Financial Officer and Treasurer from 2017 until March 2023, and as Vice President, internal audit of BioMed Realty Trust, Inc. (formerly NYSE: BMR) until December 2016, having joined BioMed Realty in 2009. Ms. Hastings currently oversees key functions for our development, asset management, human resources and information technology functions, including cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Since 2016, we have retained a third-party information technology specialist to develop and maintain our information technology infrastructure and network, who has extensive experience in the development of business processes, system infrastructure design and cybersecurity for large-scale, institutional real estate companies.


text: Management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving cybersecurity processes, reviewing cybersecurity assessments and other cybersecurity-related matters, and responding to cybersecurity incidents, including reporting to the audit committee for certain cybersecurity incidents. Our management team also evaluates the potential impact of cybersecurity incidents to determine materiality. This evaluation considers factors such as the nature and scope of the incident, and its effects on operations, assets, or reputation. The audit committee holds quarterly meetings and receives periodic reports from management, including our Chief Operating Officer and third-party information technology expert, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.


text: We have established processes, procedures, and controls to identify, manage, assess, and mitigate material risks from cybersecurity threats which are designed to help protect our information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while ensuring business resiliency, protecting employee and customer information from unauthorized access or attack, and securing our networks, systems, devices, products, and services, or our Cybersecurity Risk Mitigation Practices. We conduct tests on our systems and incident simulations to help discover potential vulnerabilities and ensure the effectiveness of our Cybersecurity Risk Mitigation Practices. We engage external parties, including consultants, independent privacy assessors, computer security firms, and risk management and governance experts, to enhance our cybersecurity oversight. We also regularly consult with industry groups on emerging industry trends. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners.

companyName: PC CONNECTION INC

ticker: CNXN


text: As of the date of this Annual Report Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risks titled "Cyberattacks or the failure to safeguard personal information and our IT systems could result in liability and harm our reputation, which could adversely affect our business" and "Our business could be materially adversely affected by system failures, interruption, integration issues, or security lapses of our IT systems or those of our third-party providers," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our Cybersecurity Risk Mitigation Practices are managed on a day-to-day basis by members of our Information Security Steering Committee, or the Committee, and are overseen by our Board of Directors. The Committee is composed of senior management, including our Chief Information Officer and Chief Financial Officer, and senior vice presidents from various areas of the organization including IT, compliance, legal, operations and human resources, including the Vice President of Information Security and Compliance. The Vice President of Information Security and Compliance has over 40 years of IT experience and is a certified information systems security professional. The Chief Information Officer has over 10 years of experience managing cybersecurity, data protection, and incident management teams, and over 20 years of experience managing compliance and regulatory processes and controls.


text: As part of the administration of our Cybersecurity Risk Mitigation Practices, the Committee is tasked with managing and mitigating our exposure to cybersecurity threats, creating our cybersecurity policies, and establishing short and long-term cybersecurity goals and objectives that are designed to protect our information systems. The Committee is also responsible for planning ordinary course security projects and initiatives aimed at ensuring that our organizational leaders are informing our employees about our cybersecurity policies and about cybersecurity basic practices. On a periodic basis, the Committee meets to review the performance and effectiveness of our Cybersecurity Risk Mitigation Practices.


text: Members of the Committee will present the results of the periodic performance and effectiveness review to our Board of Directors, who oversee our risk management processes directly and through its committees. These results, along with other cybersecurity topics including updates on previously identified material cybersecurity threats or incidents, are presented at regularly scheduled meetings. Members of the Committee will also notify our Board of Directors between such meetings regarding significant new or updates to ongoing cybersecurity threats or incidents.


text: We maintain an information security program as part of our enterprise-wide risk management system. Our information security program is managed by our Group Vice President, whose portfolio includes top level oversight of information technology, information security and IT risk management. The Group Vice president is responsible, along with his team, for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. Our Group Vice President has served in that role since 2012 and has been in cybersecurity related roles for 25 years. Our Group Vice President and IT Director provide periodic updates to our Board of Directors, Audit Committee, and other senior management members. These updates include, among other risk management issues, updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Clean Energy Fuels Corp.

ticker: CLNE


text: Our program is regularly evaluated by internal and external experts with the results of those reviews reported to the Board of Directors, Audit Committee, and senior management. We also collaborate with thought leaders in cybersecurity including with key vendors, business partners, cybersecurity and data breach response counsel, and industry participants as part of our continuing efforts to evaluate and improve the effectiveness of our information security policies and procedures. This collaboration allows us to rapidly adopt industry best practices developed through firsthand experience mitigating cyber incidents.


text: When reviewing potential threats or cybersecurity incidents, our Board of Directors has delegated the authority to the Audit Committee to setup crisis incident management teams comprised of senior management and appropriate specialists. These crisis incident management teams report on an as needed basis to the Audit Committee and full Board of Directors to keep them informed and seek direction where necessary.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including " We rely on information technology in our operations, and any material failure, inadequacy, interruption, or security failure of that technology could harm our business," for additional discussion about cybersecurity-related risks.


text: Cybersecurity is an integral part of risk management at our company. We have engaged a third-party cybersecurity firm along with our information technology director to monitor the cybersecurity risk facing our company and provide quarterly update to the Board of Directors (the "Board"). Cybersecurity is overseen by the Board and the Audit Committee of the Board (the "Audit Committee"). Pursuant to its charter, the Audit Committee has the responsibility and duty to review and discuss with management on a regular basis our company's programs, policies and procedures related to information security and data protection, including data privacy and network security, as they relate to financial reporting. The Board and the Audit Committee receive reports on cybersecurity from management at least quarterly and more often as needed. These reports on cybersecurity typically encompasses the nature and threats, defense and detection capabilities, and training activities at our company.

companyName: LTC PROPERTIES INC

ticker: LTC


text: We routinely provide education, such as simulated phishing campaigns, to our employees to mitigate material risks from cybersecurity threats. This education includes cybersecurity training for new employees and training modules sent monthly to all employees. We also use various authentication technologies and third-party monitoring to mitigate material risks from cybersecurity threats. We annually retain a third-party vendor to test our information systems security and we annually review information systems security protocols of our vendors that interact with our financial data. We maintain insurance coverage that may, subject to policy terms and conditions, including deductibles, cover particular aspects of cybersecurity risk, such as data breaches, ransomware, social engineering and computer system fraud. However, it is possible such coverage may not fully insure all future costs or losses associated with all types of cybersecurity incidents such as ransomware.


text: We are not aware of any material losses to our business or results of operations in the past three years due to information technology systems failures, data breaches, or other cybersecurity incidents.


text: We rely on computer, information, network, and communication technology and related systems to operate our business and to protect confidential, restricted, and sensitive company, customer, and partner information. We have a multi-layered cybersecurity risk management program designed to identify risks related to the organization's digital and physical assets, review and assess existing security measures, and implement and manage solutions to mitigate cyber risks. These solutions are designed to protect our facilities, our systems, our partners, our customers, and our financial data in case we experience a cyber incident. Protection includes phishing detection, social engineering, executive targeting, brand impersonation, configuration mistakes, sensitive data leakage, leaked credentials, malicious attacks, third-party risks, vulnerabilities, insider threats (both intentional and unintentional), and password attacks. This type of ongoing vulnerability risk management is crucial as the organization and the external threat landscape evolves. This cybersecurity risk management program is incorporated as part of the Primoris Enterprise Risk Management Program.

companyName: Primoris Services Corp

ticker: PRIM


text: Our cybersecurity policies and processes are based on the controls within the National Institute of Standards and Technology ("NIST") Framework, and we engage a number of external parties to enhance our cybersecurity oversight. For example, every other year, a third-party consulting firm performs an assessment of our cyber program, measuring our program against the NIST controls with a Capability Maturity Model Integration overlay to determine the program's maturity. The assessment findings are disclosed to the Audit Committee of the Board of Directors and our cross-functional management Security Steering Committee ("SSC"). Any improvements resulting from the assessment are identified, along with action plans. We also use a third party to perform an annual Breach Assessment targeting our external and internal network environment to determine the strengths and any weaknesses within our cybersecurity processes. As part of the Breach Assessment, our Incident Response Plan is instigated and reviewed to ensure it remains current and effective for all situations. We also have multiple third-party managed Security Operations Centers ("SOC") in place; including a SOC for logging and monitoring of security events; a SOC for endpoint managed detection and response, including identity protection; a SOC for executive digital and brand protection; and a SOC for protection of network credentials.


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's use of vendors and other third-party service providers, we conduct continuous passive scanning of the Primoris network, as well as Primoris vendors' external perimeter, on a regular basis to assess any potential vulnerabilities and weaknesses.


text: As of the date of this report, we are not aware of any known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, as discussed under Part I, Item 1A. "Risk Factors, specifically the risks titled " Disruptions to our operational systems could adversely impact our operations, our ability to report financial results and our business" and "Security breaches, cyber security attacks or other disruptions to our information technology systems and networks could adversely impact our operations or compromise the confidentiality of private customer data or our own proprietary information, " the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner, which could materially affect us, including our business operations, results of operations or financial condition.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and governance. We also maintain a cross-functional management Security Steering Committee ("SSC"), with members consisting of executive leadership, internal audit, and enterprise risk. The SSC meets quarterly and has a formal charter outlining its responsibility to provide oversite of our comprehensive cybersecurity program. The Audit Committee of the Board of Directors is briefed quarterly by the Chief Information Officer ("CIO") on the cybersecurity program, and both the Audit Committee and SSC are notified between such updates regarding significant new cybersecurity threats or incidents. The full Board of Directors also receives regular reports from the Audit Committee.


text: The CIO chairs the SSC and oversees Primoris' cybersecurity risk management program. The CIO is supported by the head of cybersecurity, who is a direct report to the CIO. The training and experience of the head of cybersecurity includes a Harvard MBA along with professional experiences involving Forensics and Investigation, NIST controls assessments and implementation, ISO 27001 assessments and implementation, Payment Card Industry Certification, and HITRUST implementation and certification. The head of cybersecurity and the security team are responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and work across the organization to assess and prepare Primoris to address cybersecurity risks. Our head of cybersecurity and the security team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to our Incident Response Plan.


text: Our employees are also an important part of protecting our digital and technical environment. A key area of the cybersecurity program is the education of employees regarding cybersecurity using security awareness training, security bulletins and phishing simulations to reinforce training on a quarterly basis. Security awareness training covers all network users. On an annual basis an Acceptable Use Policy ("AUP") is distributed to employees through our Security Awareness Training System for understanding and acknowledgement. Additionally, all new employees are provided the AUP through the Security Awareness System included with initial security training upon being granted access to our network. Additionally, all new employees are provided the AUP by Human Resources and receive initial security training upon being granted access to our network.


text: We recognize the importance of maintaining the security of our information systems and assets, and have several cybersecurity processes and controls designed to identify, assess and manage the risks associated with cybersecurity threats and cybersecurity incidents.

companyName: GLAUKOS Corp

ticker: GKOS


text: Systems and Processes To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management program is administered by the Company's legal and internal audit functions, and facilitates the process of identifying and assessing cybersecurity threat risks, as well as monitoring the effectiveness of our risk mitigation efforts. During the year, our senior management periodically identifies the cybersecurity risks facing the Company and reviews our mitigation plans related to these risks. These senior leaders conduct an evaluation of the severity of these identified risks and any changes to the risk level or the Company's mitigation efforts since the prior evaluation. The severity of risks is measured based upon the potential adverse impact that could result, the immediacy of the threat and the availability of mitigating factors, among other elements. Management may consult with outside consultants, such as legal counsel or cybersecurity advisors, in assessing risks and developing mitigation plans. The Audit Committee of the Board regularly receives reports from such outside experts in response to emerging or higher risk areas.


text: We also have specific cybersecurity risk assessment processes which help identify our cybersecurity threat risks, including a comparison of our processes to industry standards as well as periodic third-party assessments of our programs. We compare our Information Security Program with industry standards including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. In order to enhance internal expertise, members of our Global Technology Systems (GTS) department maintain various cybersecurity-related certifications. We also maintain written incident response and security policies that seek to ensure we are protected and ready to respond should a security incident occur. Incidents are investigated and analyzed for potential impact. If any potential impact is determined to present, the appropriate departments, key employees, and executive management team members are notified as part of the incident response process. Our incident response plan coordinates the activities we would take to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate potential liability and reputational damage. If appropriate, incidents may be reported to senior management, the Audit Committee or the full Board.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we undertake the activities listed below: closely monitor emerging data protection laws and implement responsive changes to our processes; conduct annual cybersecurity training for all employees and contractors who use our systems; conduct regular email phishing testing exercises for all employees to enhance awareness and responsiveness to such possible threats;


text: require employees, as well as contractors who have access to our systems or the data of our employees or customers, to treat information as confidential; performed internal audits of our use of single sign-on and multifactor authentication for key information systems;


text: schedule tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes, technologies and incident response plan; and carry cyber risk insurance that provides protection (as specified in the applicable policies) against certain potential costs and losses arising from a cybersecurity incident.


text: Engagement of Third Parties As part of the above processes, we regularly engage with assessors, consultants, and other third-parties to review our cybersecurity program. These reviews are intended to evaluate the effectiveness and robustness of the security measures implemented in our networks and information systems, identifying potential vulnerabilities, performance improvements, and recommended improvement strategies. These security assessments may focus on key areas such as user access controls, data encryption processes, auditing and monitoring of database activities, system and server configuration and update procedures.


text: Threats from Third Party Service Providers Our processes also address cybersecurity threat risks associated with our use of third-party software and system providers. Third-party risks are included within our enterprise risk management assessment program, which is discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.


text: We perform diligence on high-risk third-parties that provide us software or have access to our systems or highly sensitive information, and monitor cybersecurity threat risks identified through such diligence. New software is evaluated for risk and approved by our internal Software Approval Board before purchase or installation on our systems. We formed a Software Approval Board, which is made up of cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D, to help determine risk and impact of any potential newly proposed software. Additionally, we generally require those high risk third parties to agree by contract to manage their cybersecurity risks in specified ways. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Material Impact of Cybersecurity Threats or Incidents We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Risks Related to our Business, " included as part of our risk factor disclosures at Item 1A of this Annual Report, which disclosures are incorporated by reference herein.


text: We are not aware of any material cybersecurity incidents that have occurred in the last three fiscal years, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. At least twice a year, the Audit Committee receives a report from the head of Information Security of our cybersecurity threat risk management and mitigation strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the Company's plans to mitigate those risks, and discusses such matters with our head of GTS and other members of senior management. Potential material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management. Two members of our Board, including one member of the Audit Committee, have earned cybersecurity certifications to help them identify cybersecurity threats and oversee management's efforts to manage and mitigate them.


text: Management Oversight While the Audit Committee reviews and oversees the Company's information security efforts, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Legal department and our Internal Audit department, working with our GTS department. Members of this team include a Certified Information Systems Auditor (CISA), a Certified Information Security Manager (CISM), a Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Systems Security Professionals (CISSP), as well as members of ISACA and ISC2 industry organizations. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our information systems.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: We utilize the United States National Institute of Standards and Technology, Cybersecurity Framework (NIST CSF) in considering the design and in assessing our processes. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Index to Financial Statements We have integrated aspects of our cybersecurity risk management processes into our overall risk management program through, for example, common methodologies, reporting channels and governance processes that apply across the overall risk management program to other risk areas.


text: Our cybersecurity risk management processes include, but are not limited to: independent maturity assessments designed to help identify significant cybersecurity risks to our IT environment and systems;


text: a cyber resilience team jointly responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a risk management process for service providers, suppliers, and vendors that aligns to our compliance requirements.


text: We have not identified risks from known cybersecurity threats as a result of any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face complex risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We and our third-party providers are vulnerable to cyberattacks and security breaches that could materially disrupt or compromise our operations, data and results." There can be no assurance that our cybersecurity risk management processes, including our policies, controls or procedures, will be fully implemented as currently anticipated, complied with or effective in protecting our systems and information or in allowing us to recover from a cybersecurity incident.


text: Our Board considers cybersecurity and other information technology risks as part of its risk management and compliance oversight function. The Board oversees management's implementation of our cybersecurity risk management processes and receives reports from management on our cybersecurity risks at least twice a year. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives briefings from management on our cyber risk management processes, and it receives presentations on cybersecurity topics from our Chief Technology Officer, Chief Information Security Officer and Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team has overall responsibility for assessing and managing material risks from cybersecurity threats, and for executing on our cybersecurity risk management processes. Our Chief Technology Officer, Chief Information Officer and Chief Information Security Officer, among others, have decades of combined experience in areas such as information technology, compliance, and cybersecurity program design and management. Additionally, certain leaders and personnel within the cybersecurity operations team hold industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager. Our management team works closely with our cybersecurity operations team to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT, Operational Technology (OT), and products and services environments.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, computer hardware and software, and our critical data, which includes proprietary, confidential and sensitive data, including, without limitation, personal data (such as health-related data), intellectual property and trade secrets, referred to collectively as Information Assets. Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: Risks from cybersecurity threats are among those that we address in our general risk management program. We rely on a multidisciplinary team (including personnel from our information security function, management and third-party service providers, as needed, as described further below) to help identify, assess and manage our risks. We identify and assess such threats by, among other things, monitoring and evaluating the threat environment using various methods, including, for example, manual and automated tools, information security tools and platforms to alert us to potentially unwarranted activity on our networks, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting risk and vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. For example, the risk management and reduction measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management, and disaster recovery/business continuity plans; incident detection and response solutions; internal and/or external audits to assess our exposure to cybersecurity threats; documented risk assessments; implementation of certain security standards/certifications; encryption of data; network security controls; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; employee security training; penetration testing; and cyber insurance. In addition to the above, management obtains a third-party review and formal certification of its information management system policies and procedures, which has been collated into an Information Security Management System (ISMS) which is maintained to ISO 27001 standards.


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions including contract research organizations, or CROs, for managing clinical trials, professional services, SaaS platforms, managed services, property management, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions. We generally engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement.


text: For service providers that provide particularly critical services to us or process particularly sensitive information for us, we may also require that such providers possess at least one of the following certificates, reports, or procedures: SOC 2 Type 2; ISO 27001; annual penetration tests; and/or red/blue team tests.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled: Cyber-attacks, failures in or interruptions of, or other compromise of our information technology systems, or those of third parties with whom we work, or our data could result in adverse consequences that materially affect our business, including without limitation, regulatory investigations or actions, litigation, fines and penalties, information theft, data corruption, harm to our reputation and brand, significant disruption of our business operations and other adverse consequences.


text: Our cybersecurity risk management strategy relies on input from management, including our Vice President, Head of Computational & Structural Science, who reports directly to our Chief Technology Officer, and has over 10 years of experience in developing and implementing cybersecurity strategies for companies in the biopharmaceutical industry, as well as our Chief Financial Officer and Chief Legal Officer and General Counsel. We have also formed an Information Risk Assessment Committee, or IRAC, consisting of senior members of the finance, legal, operations and information technology functions, to oversee the management of information security as a whole, including integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees. The IRAC meets on a regular basis, generally quarterly, to discuss cybersecurity risk and to review our cybersecurity program.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our incident response team, which includes, but is not limited to, our Vice President, Head of Computational & Structural Science, Chief Legal Officer and General Counsel and Chief Financial Officer. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Management, including the IRAC, is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors.


text: Our board of directors oversees our risk management strategy with respect to cybersecurity threats. The board, through its Audit Committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our management, including our Vice President, Head of Computational & Structural Science, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.


text: The global data protection landscape is rapidly evolving, and we may be impacted by or subject to new, amended, or existing laws and regulations in the future, including as our operations continue to expand or if we begin to operate in foreign jurisdictions. The risk of a security breach or disruption or data loss, particularly through social engineering attacks, cyber-attacks, or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: We collect and maintain data and information necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business, including systems infrastructure operated and maintained by third-party service providers. In the ordinary course of business, we collect, store, and transmit confidential information, including intellectual property, proprietary business information and personal information. It is critical that we do so in a secure manner to maintain the privacy, security, confidentiality, and integrity of such confidential information.


text: We have established physical, electronic, and organizational measures to safeguard and secure our systems and facilities to prevent an information compromise. We rely on commercially available systems, software, tools and monitoring to provide security for our information technology systems and the processing, transmission, and storage of digital information. We have also outsourced elements of our information technology infrastructure, and as a result, a number of third-party vendors may or could have access to our confidential information.


text: The cost to mitigate, investigate and respond to potential security incidents, breaches, disruptions, network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures to protect our data and information technology systems, our efforts to address these potential risks may not be successful, and could result in unexpected interruptions, delays, cessation of service and other harm to our business and competitive position.


text: If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could delay our regulatory approval efforts and significantly increase our costs as a result of efforts to recover or reproduce the lost data. Moreover, if a real or perceived security breach affects our systems (or those of our third-party service providers), or result in the loss of or accidental, unlawful, or unauthorized access to, use of, release of or other processing of personally identifiable information or clinical trial data, our reputation could be materially damaged.


text: In addition, a breach may require notification to governmental agencies, the media, or individuals pursuant to applicable data privacy and security laws. We would also be exposed to a risk of loss, negative publicity, harm to our reputation, governmental investigation and/or enforcement actions, claims or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition.


text: Cyber Risk Governance The Audit Committee is a sub-committee of our Board of Directors and is delegated to the role of cyber risk oversight for the Company.


text: Our management team, including the CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CIO reports the progress of cyber risk reduction initiatives to the Audit Committee on a periodic basis. The CIO has extensive information technology experience in the corporate environment.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: In February 2024, we chartered the Information Systems, Data and Cybersecurity Governance Committee (the "Cybersecurity Committee"), which is comprised of the Company's business unit leaders and is responsible for the management of our cyber risk exposure and monitoring the effectiveness of the cybersecurity program. The Cybersecurity Committee reports the progress of cyber risk reduction initiatives to our senior leadership and the Audit Committee on a periodic basis.


text: Cyber Risk Management Strategy We have a cyber risk management policy and asset-based cyber risk management methodology for the continuous identification, assessment, and management of our cyber risk exposure. Our cyber risk managers have been trained in our cyber risk management policy and methodology. The methodology is as follows: Maintaining an up-to-date and accurate inventory of all assets (e.g., data, systems, hardware, software, and vendors).


text: Categorization of all assets based on the criticality of the data processed and the assets criticality to the continuity of business operations.


text: A profile is maintained of the most likely threats, their intent, and the impact the threat may have on the confidentiality, integrity, and availability of Company assets. Evaluation of relevant risk-based scenarios or vulnerability of an asset and how a threat may exploit the asset. Implemented security controls or "mitigating factors" are considered for each scenario.


text: Considering the asset, threat, risk-based scenario or vulnerability, and the mitigating factors, a likelihood and impact determination is made to calculate the final risk level. Risk reduction plans are determined and used to prioritize security program initiatives. Risk mitigations are tracked and monitored in a risk register.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: Cyber Risk Exposure Our top cyber risks have been grouped into genericized categories to avoid disclosure of sensitive information but include sufficient detail for a reasonable investor to understand our cyber risks and maintain confidence we act in good faith to reduce our cyber risk exposure. In the fourth quarter of 2024, we performed a risk analysis of all critical assets, determining the following are our current top cyber risks, none of which are material: Compromise to the confidentiality of intellectual property. Compromise to the confidentiality and integrity of financial records. Compromise to the confidentiality of employee records. Compromise to the confidentiality, integrity, and availability of core business systems. Compromise to the confidentiality, integrity, and availability of critical third-party vendors supporting the continuity of business operations.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We depend on our information technology systems, and any failure of these systems could harm our business. Any real or perceived security breach, loss of data, and other disruptions or incidents could compromise the privacy, security, integrity or confidentiality of sensitive information related to our business or prevent us from accessing critical information and expose us to liability and reputational harm, which could adversely affect our business, results of operations and financial condition."


text: Third Party Risk Management We leverage multiple third parties to support our business operations. Throughout the lifecycle of the vendor relationship, security is integrated as part of each process. We maintain a vendor inventory, categorized based in risk tiers, and perform due diligence of the vendor's security practices commensurate with the risk tier. Vendor contracts and security practices are monitored to ensure an accurate assessment of risk is maintained.


text: Third Party Support of the Cyber Risk Management Program We employ third parties to support our cyber risk management program in the following ways: Use of internal and external auditors to maintain compliance with regulatory requirements.


text: Use of cybersecurity consultants and managed security services providers to supplement the security program practices and evaluate the program's effectiveness, specifically: Governance, risk, and compliance services. Penetration testing and vulnerability management. Continuous security event monitoring. Data loss prevention.


text: Incident Management We make continuous efforts to maintain the ability to respond quickly and effectively to security incidents to minimize their impact. We implement an incident response policy, incident response plan, and deploy comprehensive continuous security monitoring solutions to monitor events occurring across its assets. Additionally, a material risk determination model enables our cyber incident response team and senior leadership to determine materiality.


text: We recognize the importance of maintaining the integrity of our information technology systems and safeguarding the confidential business and personal information we receive and store about our employees, customers and suppliers. We have a cybersecurity risk management program in place to identify, assess, and manage risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cyber attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Among the key features of our program are:

companyName: TopBuild Corp

ticker: BLD


text: Periodic independent, third-party reviews of our program and its maturity based on the National Institute of Standards and Technology (NIST) cybersecurity framework;


text: Strategic engagements of consulting firms and legal advisors to advise the Board and our executive officers regarding the structure and oversight of our cybersecurity risk management program, cyber strategy framework evolution, risk-based assessments, incident response services, and cyber technology;


text: Consulting with external advisors and specialists on specific projects regarding opportunities and enhancements to strengthen our cyber practices and policies on an as needed basis;


text: Periodic review of SOC1 and SOC2 audit reports submitted by our strategic third-party technology suppliers, as prepared by their external auditors;


text: Ongoing cybersecurity training for employees; and Periodic testing of incident response procedures. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help test, develop and manage our cybersecurity risk management program.


text: Our cybersecurity risk management program includes technology and processes designed to maintain active security of our information technology systems. We have not experienced a material cyber breach in the last three years. We do not believe that any risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to the Company associated with cybersecurity incidents, see "In the event of a cybersecurity incident, we could experience operational interruptions, incur substantial additional costs, become subject to legal or regulatory proceedings or suffer damage to our reputation," included in Part I, Item 1A (Risk Factors) of this Annual Report.


text: To help identify and manage cybersecurity risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts the Company and our technology systems. In this regard, we conduct due diligence of significant third-party service providers who will have access to our information technology systems and incorporate cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations. Further, our external auditor reviews our processes designed to control access to our information technology systems as part of its assessment of our internal controls.


text: Incident Response Procedures We have in place a cyber incident response plan outlining procedures to follow in the event of a cybersecurity incident. Under the plan, we established a cross-functional critical response team (CRT) with expertise in various subject matter areas responsible for initiating and leading our incident response procedures. The CRT is under the direction of our Chief Information Officer and is comprised of our Director of Information Technology, Chief Accounting Officer, Assistant General Counsel and Chief Compliance Officer, Senior Manager of Risk and Insurance, and certain other members of management. The plan provides that our CRT will conduct an impact assessment in the event of a cybersecurity incident meeting pre-established criteria, or which may otherwise impact the operations or finances of the Company. If any such cybersecurity incident is determined by the CRT to have the potential to materially impact the Company, such event would be elevated for further review and assessment by a senior leadership team consisting of our Chief Executive Officer, Chief Financial Officer, General Counsel and other members of our executive leadership team. Under certain circumstances, such review and assessment would include reporting to and oversight of the Board.


text: Our full Board is responsible for oversight of risks from cybersecurity threats, including our cybersecurity risk management program. In carrying out its oversight responsibilities, the Board receives regular cybersecurity program updates and quarterly scorecard assessments from our Chief Information Officer, which cover topics related to information security, privacy and cyber risks, and our risk management processes, including the status of any recent cybersecurity events meeting specified criteria, the emerging threat landscape, and the status of capital investments in our information security infrastructure.


text: At a management level, our cybersecurity risk management program is led by our Chief Information Officer, who reports to our Chief Executive Officer. Under our Chief Information Officer's leadership, the cybersecurity team implements and provides governance and functional oversight for cybersecurity controls and services. The team's credentials include Certified Chief Information Security Officer, Certified Information Security Manager and Certified Information Systems Security Professional.


text: To help identify, assess, and manage risks from cybersecurity threats, we have integrated cybersecurity risk management into our broader, Company-wide enterprise risk management (ERM) evaluation and strategy process, which is led by our executive officers, overseen by the Audit Committee of the Board, and reviewed annually by the full Board. Our ERM process takes a top-down, enterprise view of material risks impacting our Company, including credit, liquidity, strategy, cybersecurity, and operational risks, and is an ongoing process consisting of risk identification, risk rating, analysis and action plans, and reporting and monitoring. Employees responsible for assessing identified risks deliver an update quarterly to our senior leadership team, which consists of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, Chief Human Resources Officer, Chief Growth Officer, and Vice President of Supply Chain. Status updates with respect to these risk areas are delivered quarterly by management to the Audit Committee of the Board, and full risk assessment results are presented by management annually to the full Board.


text: We rely on information technology and data to operate our business and develop, market, and deliver our therapies to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, lab equipment, software, and our critical data includes confidential, personal, proprietary, and sensitive data (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business. Our general risk management strategy is designed to manage identified material risks, which would include material cybersecurity risks.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities.


text: We rely on a multidisciplinary team (including from our information security function, management, and third party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; credit and background checks on our and/or third parties' personnel; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; red/blue team exercises; cyber insurance; dedicated cybersecurity staff/officer.


text: We work with third parties from time to time that assist us from time to time to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing.