text: As part of our broader risk management framework, from time to time, we seek to identify potential cybersecurity risks to our business and improve our policies and processes to address such risks. We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality reviews and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication and recovery plans in the event of a cybersecurity threat or incident.


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We are also engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT

secItem: Item 1C


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of third-party providers to ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Our Nomination and Corporate Governance Committee has specific oversight responsibility for cybersecurity The Nomination and Corporate Governance Committee reviews and discusses with management our policies, practices and risks related to information security and cybersecurity.


text: Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. We utilize cybersecurity consultants to monitor and report cybersecurity threats or incidents to our chief financial officer and to resolve issues arising from such threats or incidents. Our chief financial officer updates the Nomination and Corporate Governance Committee on any risks related to cybersecurity as needed.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in depth, layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected persistent threats. Notwithstanding the strength of our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third party service providers are under constant threat, creating the possibility of future events. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology based products and services by us and our customers.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, and are managed and monitored by a dedicated information technology team, which is led by our Director of Information Technology, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers. We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their estimated impact on the Company's risk environment.


text: Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including those resulting from prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures, interruptions and cybersecurity breaches in our information technology and telecommunications systems and of third-party service providers could have a material adverse effect on us."


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level committee designated by our Board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Bank's cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board receives an Annual Report from the Director of Information Technology on the Bank's Information Technology Systems, including cybersecurity risk.


text: Our ECVs are fitted with a networking device connecting the vehicle to our proprietary cloud-based software, which enables end-users to collect data about vehicle configuration, vehicle status and user efficiency through a system of digitally enabled components, which we sometimes refer to as "smart components." With the permission of the end-users of the vehicles, we received data collected from approximately 950 Metro units that we put into service through a company affiliated with our former parent company, CAG Cayman, in the Chinese market. This data included vehicle-specific data collected for operational analysis, which we used to make improvements in the quality and durability of such components. We enable end-users to collect, store and analyze data using tools that we have developed but we do not have access to this end-user collected data unless we request and receive access from the end-user. We do not currently collect, use or store any vehicle-specific or driver-specific data in any region and do not intend to do so in the future.

companyName: Cenntro Inc.

ticker: CENN


text: While to our knowledge no previous cybersecurity incidents have occurred, we seek to continuously expand and improve our information technology systems, including implementing new internally developed and/or external industry standard enterprise resource planning systems ("ERP systems"), to assist us in the management of our business. We maintain information technology measures designed to protect us against intellectual property theft, data breaches and other cyber-attacks. The implementation, maintenance and improvement of these systems require significant management time, support and cost. Moreover, there are inherent risks associated with developing, improving and expanding our core systems as well as implementing new systems, including the disruption of our data management, procurement, manufacturing execution, finance and supply chain processes.


text: Elements our cybersecurity information technology measures include efforts to identify, prevent, detect, mitigate, and remediate cybersecurity risks and incidents through: • Cybersecurity risk assessments for identification of material cybersecurity risks to our critical systems, information, products, and our technology environment; • Security personnel and vendors responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • Training and awareness programs for our personnel and senior management to drive adoption and awareness of cybersecurity processes and information technology measures; • A cybersecurity monitoring program responsible for tools that produce alerts and reports of suspicious activity for the prevention of and response to cybersecurity incidents; • Internal testing and assessments, where appropriate, of our cybersecurity information technology measures; • Management of external consultants and services engaged by us, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity information technology measures; and • A third-party risk management process for evaluating cybersecurity threats associated with our use of service providers, suppliers, and vendors.


text: Despite network security and back-up measures, our information technology systems are potentially vulnerable to physical or electronic break-ins, computer viruses and similar disruptive problems. Despite precautionary measures to prevent unanticipated problems that could affect our information technology systems, sustained or repeated system failures that interrupt our ability to generate and maintain data could adversely affect our ability to manage our data and inventory, procure parts or supplies or manufacture, sell, deliver ECVs, or achieve and maintain compliance with, or realize available benefits under, tax laws and other applicable regulations.


text: We cannot assure you that any of our new information technology systems or their required functionality will be effectively implemented, maintained or expanded as planned. If we do not successfully maintain our information technology or expand these systems as planned, our operations may be disrupted, our ability to accurately or timely report our financial results could be impaired, and deficiencies may arise in our internal control over financial reporting, which may adversely affect our ability to certify our financial results. Moreover, our proprietary information could be compromised or misappropriated, and our reputation may be adversely affected. If these systems or their functionality do not operate as we expect them to, we may be required to expend significant resources to make corrections or find alternative sources for performing these functions.


text: The risks from cybersecurity threats are monitored and managed by the Company's information systems team members who have relevant expertise with such potential threats, and who operate in collaboration with other Company functions. The Company's Audit Committee is responsible for overseeing cybersecurity risk and are informed in a timely manner of any incidents considered potentially serious, together with details on the prevention, detection, mitigation and remediation of such incidents.


text: Our business operations rely on the secure processing, storage, and transmission of certain confidential, sensitive, proprietary, and other information, as well as personal information about our customers and employees.

companyName: CHARLES & COLVARD LTD


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated with our overall risk assessment process and has been embedded in our operating procedures, internal controls and information systems.


text: The underlying controls of the cybersecurity risk management program are based on recognized best practices consistent with National Institute of Standards and Technology, or NIST and Cybersecurity Framework, or CSF. We have invested and continue to invest in risk management and information security and data privacy measures in order to protect our systems and data, including employee training, organizational investments, incident response plans, and technical defenses. The cost and operational consequences of implementing, maintaining, and enhancing data or system protection measures could increase significantly to overcome intense, complex, and sophisticated global cyber threats.


text: We constantly monitor our cybersecurity environment and coordinate with third-party consultants to provide regular cybersecurity training and promote cybersecurity awareness across the organization.


text: In addition, we and certain of our third-party vendors receive and store certain information associated with our sales operations and other aspects of our business. In connection with our e-commerce business, we rely on encryption and authentication technology licensed from third parties to effect secure transmission of confidential information. Our disclosure controls and procedures address cybersecurity and include elements intended to ensure that there is an analysis of potential disclosure obligations arising from security breaches. We also maintain compliance programs to address the potential applicability of restrictions against trading while in possession of material, nonpublic information generally and in connection with a cybersecurity breach. The breakdown in existing controls and procedures around our cybersecurity environment may prevent us from detecting, reporting or responding to cyber incidents in a timely manner and could have a material adverse effect on our financial position and value of our Company's stock. Despite our implementation of security measures, our IT systems and e-commerce business are vulnerable to damages from computer viruses, natural disasters, unauthorized access, cyber-attack, and other similar disruptions.


text: On or about June 28, 2023, we identified a cybersecurity incident that temporarily disrupted the Company's IT network and resulted in some limited downtime for certain systems. Through investigation, we confirmed that this event was related to an apparent ransomware attack involving the unauthorized encryption of some of our files and the deployment of malware. This incident required us to temporarily implement manual processes to conduct our operations with as little disruption to production as possible. There were no payments made in this cybersecurity incident and no material impact on the operations of our business operating segments.


text: We have not encountered any cybersecurity threats or incidents that have had a material impact on our business. We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. See "Risk Factors– Risks Related to our Operations - Our information technology, or IT, infrastructure, and our network has been and may be impacted by a cyber-attack or other security incident as a result of the rise of cybersecurity events."


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports on our cybersecurity risks and processes from management. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Board also receives briefings from management on our risk management program, which includes our cybersecurity risk management. Presentations on cybersecurity topics are made as appropriate by our Chief Executive Officer.


text: Our management team, including our Chief Executive Officer and Chief Financial Officer, whom are supported by our information technology consultant, are responsible for assessing and managing our material risks from cybersecurity threats. This team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team members have relevant experience in risk assessment and management, and our information technology consultant has over 25 years of IT and Cybersecurity experience.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from our third - party vendors; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks leveraging sophisticated AI-enabled tools from nation-state actors that might target our ecosystem through specific industry verticals. Any such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially adversely affect our business strategy, financial condition, performance, our brand and results of operations.

companyName: EPLUS INC

ticker: PLUS


text: We have a dedicated team of information security professionals (our "information security team") who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO"). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team's structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive and collaborative culture of security, whereby all our employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.


text: The processes overseen by our information security team are integrated with our enterprise risk management ("ERM") program, including routine reporting to our executive team on cyber risk through the different levels of our ERM governance structure including our risk management frameworks and processes. We undergo routine testing of both the design and operational effectiveness of our security controls, consult with industry leaders on best practices, and ensure alignment with relevant industry frameworks and laws, as well as auditing by our internal audit team. Our cybersecurity program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments. In addition to our policies and procedures designed to manage and identify cybersecurity risks, we maintain an incident response plan designed to contain, analyze, remediate, and communicate cybersecurity matters to help ensure a timely and appropriate response to cybersecurity incidents.


text: Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors, and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.


text: Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends, including those related to the use of AI as both a threat and a defense mechanism. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not be discovered, occur, or result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, please refer to Item 1A. "Risk Factors."


text: Management and Strategy Roivant's corporate information security organization, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cybersecurity threat and incident detection and response centrally at Roivant and the majority of our Vants. Certain of our Vants, including Immunovant and our healthcare technology Vants, have established and maintain separate cybersecurity functions which are similarly designed to protect their information and assets from cybersecurity threats or incidents.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: Roivant and the Vants' information security organization manages a robust enterprise security structure with the goal of preventing and mitigating any cybersecurity incidents, while simultaneously working to continually increase information technology system resilience designed to minimize any business impact should a cybersecurity incident occur. Central to Roivant's information security organization is our Cybersecurity Incident Response Team, which is responsible for the protection, detection and response capabilities used to protect our data and enterprise computing networks. A Cybersecurity Risk Governance Committee oversees processes for identifying and mitigating cybersecurity threats and incidents and helps align our risk exposure with our strategic objectives. Cybersecurity threats and incidents deemed to have a moderate or higher business impact, even if immaterial to us as a whole, are reported to the Corporate Risk Management Committee and shared with Roivant's board of directors.


text: Roivant and the Vants implement multiple levels of cybersecurity measures, including standard malware detection and prevention software, email security programs, privileged access management, vulnerability detection and remediation software, security patching management, security event logging and reviews and special isolation and access controls for data repositories that may contain sensitive information, including protected health information.


text: Roivant and the Vants' cybersecurity programs are informed by industry standards and include periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management and monitoring tools, designed to monitor, identify and manage risks from cybersecurity threats and incidents. In addition, we have implemented employee security and awareness training related to cybersecurity threats and incidents.


text: Roivant and the Vants undergo periodic internal compliance audits and external reviews to evaluate our controls, including cybersecurity controls. Additionally, a majority of our information technology systems are built on services provided by third parties. In an effort to minimize third-party risk, we have established a process designed to assess the cybersecurity practices of third-party suppliers and related risks, including through review of relevant supplier certifications and cybersecurity procedures and responses to standardized information-gathering questionnaires, as we deem applicable and appropriate. Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from any such compromise or failure.


text: Related to Cybersecurity Risks Roivant's board of directors oversees our overall risk management strategy, including with respect to cybersecurity risks. Cybersecurity risk management policies and procedures are integrated into our overall risk management strategy, which is overseen by the audit committee of the board of directors ("Audit Committee"). At least annually, the Audit Committee discusses our risk management program, including any information security and technology risks and findings from any audits, with our Chief Accounting Officer and other members of our management team.


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy centrally at Roivant and the majority of our Vants. Our CISO has extensive cybersecurity experience across a wide array of industries, with previous leadership positions specializing in safeguarding healthcare data across various health technology companies.


text: Immunovant and the healthcare technology Vants that have established and maintain separate cybersecurity functions, governance is similarly overseen in the first instance by the boards of directors of those Vants as part of their overall risk management strategy, with ultimate oversight on a company-wide basis by the Roivant board of directors.


text: We are increasingly dependent on third-party provided software applications and computing infrastructure to conduct key operations. We depend on both our own procured systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: the importance of cybersecurity to our business, we maintain a cybersecurity program that is based on a set of cybersecurity policies and processes to support our controls and our preparedness for treatment of identified information security risks. We also undergo periodic evaluations of our cybersecurity program through cybersecurity assessment and cybersecurity incident response tabletop exercises, conducted by our cybersecurity advisors.


text: As a result of such assessments and exercises, a number of processes have been established or are being improved upon to support the protection of our data and systems.


text: In the event of a cybersecurity incident, we maintain a Cybersecurity Incident Response Plan. Pursuant to the plan and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We have a relationship with various law firms to assist with advisory on legal aspects of containing incidents and communicating accordingly.


text: Management Oversight The existing controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our information technology ("IT") consultant. Our IT consultant leverages its over 35 years of experience. Our IT consultant is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity incidents. Our IT consultant reports on its activities to senior management who then assess and manage risks of cybersecurity threats.


text: While our Board of Directors (the "Board") has overall responsibility for risk oversight, the Audit Committee of the Board (the "Audit Committee") oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, monitoring, reporting and, where appropriate, providing recommendations to the Board regarding compliance with our internal policies and its progress in remedying any material deficiencies, including those related to our security policies, including the physical safeguarding of corporate assets and security of our networks and information systems. The Audit Committee receives periodic updates regarding the cybersecurity program, including top threats and risks, and updates on the cybersecurity roadmap.


text: Risks maintain a Risk Management Policy that governs the process in which we identify cybersecurity risks, evaluate their associated impacts and risk levels, and document them accordingly in the Cybersecurity Risk Register.


text: For additional information, see "Item 1A—Risk Factors." In the last reporting year, we did not experience any material cybersecurity incidents or threats.


text: Risk Management and Strategy Overall Process The Company regards information and data as valuable assets. As a result, safeguards implemented protect corporate informational and data assets. Associated and established technology resources maintain the integrity, availability, and privacy of confidential information of the respective assets. Additionally, we maintain a similar risk-based approach to our third-party vendors including identifying and overseeing cybersecurity risks they present.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: The Company employs comprehensive methodologies for risk assessment and diligently identifies and evaluates potential cybersecurity threats and vulnerabilities across our systems, networks and data assets. This process involves regular examinations of emerging threats, conducting penetration tests, vulnerability scanning and thorough analysis of industry-specific risks.


text: The Company continues to expand investments in information technology security, including continuous end-user training, layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting.


text: The Company's Information Security Officer and Chief Information Officer are responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.


text: The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network such as Distributed Denial of Service attacks, Corporate Account Takeover schemes, or ransomware. Cybersecurity threats that are identified and deemed material are escalated and communicated directly to the Incident Response Team, in collaboration with relevant information technology personnel, insurance providers, legal counsels and when necessary, external cybersecurity firms specializing in forensic investigations.


text: The Company sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the senior and executive management levels, and annually at the Board of Directors level, to validate roles and responsibilities, and response protocols respective to cybersecurity threats.


text: Third-party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor and its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended June 30, 2025. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has oversight responsibilities to ensure effective governance in managing these risks because it recognizes the significance of these threats to our operational integrity, shareholder and customer confidence and reputation.


text: The Board is responsible for the oversight of cybersecurity risk management and is composed of members with expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.


text: The Chief Information Security Officer ("CISO"), and the Chief Information Officer ("CIO"), each play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to both the Board and the Audit Committee as part of managements reporting. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;


text: Incident reports and issues identified from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our regularly scheduled Board meetings, the CISO and the CIO regularly communicate regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Cyber Risk Management Personnel The CISO directly reports to the Chief Administrative Officer ("CAO"). The CISO and CAO meet regularly to discuss both internal and external cybersecurity risks and incidents. The CIO and CAO also regularly meet with the Chief Executive Officer ("CEO") to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our CISO. The CISO experience includes prior leadership roles within the Company, where they developed an expert level of understanding of the intersection between financial regulations and cloud-based technologies. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. The CIO and CISO oversee our governance programs, work with our technology-focused leaders and partners to align security and compliance, and has developed our employee security awareness training program.


text: Monitoring Cybersecurity Incidents The CIO and CISO utilize vendor relationships, the Financial Services Information Sharing and Analysis Center and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.


text: The Company recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. The Company believes that cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: The Company has an information security program and procedures in place to protect, identify, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. The Company uses various security tools that help prevent, identify, investigate, resolve and recover from identified vulnerabilities and security incidents to protect our information systems and data from cybersecurity threats. This framework is implemented and overseen by management's information security department which is led by the Information Technology ("IT") Support Associate Director and overseen by the Company's IT Steering Committee. The IT Support Associate Director has over twenty years of experience in technology management and cybersecurity. The IT Steering Committee is comprised of the Company's two Associate IT Directors, the CEO, and CFO and convenes quarterly to review IT control policies and procedures are properly followed and any new employees were properly onboarded in compliance with security procedures.


text: The Company employs third-party risk security vendors to identify, mitigate, and remediate cybersecurity risks; however, we rely on the third parties we use to implement security programs commensurate with their risks, and we cannot ensure in all circumstances that their efforts will be successful. The Company employs a third-party vendor to securely host the Company's data in a cloud-based storage system. The third-party vendor conducts quarterly vulnerability scans on both the hosted data environment and the Company's corporate data network. Scans of the Company's firewall are conducted regularly by the third-party vendor. Any necessary remediation would also be provided by the third-party vendor after the scan, but none has been required. The Company uses multiple third-party developed software to continually monitor technology systems for viruses, malicious software, executable harmful files, and other cybersecurity risks. The Company requires the annual submission of SOC 1 security certificates from our third-party vendors which have access to our financial and sales data. The Company also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity related incidents.


text: The Company recognizes that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each employee is required to complete information security and data privacy training to build awareness of cybersecurity risks to the organization. The Company has engaged a third-party vendor to periodically send each employee an email that mimics a potentially harmful phishing attempt each month and to report to management the results of the phishing security test.


text: The Board of Directors are acutely aware of the critical nature of managing risks associated with cybersecurity threats. Each quarterly meeting, management presents a cybersecurity update which includes results of testing by third-party vendors and any suspected cybersecurity incidents to the entire Board of Directors. Management would report any material cybersecurity breach immediately to the full Board of Directors. The Company has a written policy for the employee reporting of any cybersecurity suspected incidents.


text: The Audit Committee of the Board has the primary responsibility to oversee effective governance in managing risks associated with cybersecurity threats. Our Audit Committee is composed of members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: The Bank has implemented an information security program that encompasses the Bank's cybersecurity efforts as part of its risk management process. Risk assessments, including Information Technology and Cybersecurity Risk, are conducted annually by the Chief Risk Officer, Information Technology Officer and Information Security Officer to identify, assess and mitigate risks.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: The Bank recognizes the need for sound physical and internal controls over its critical financial data, confidential information and digital assets to ensure the accuracy, integrity, and confidentiality of the processed information. As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies.


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors annually approve this information security program and regularly receive reports from the Bank's Information Security Officer and Information Technology Officer that outline the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer and Information Technology Officer update the Boards of Directors through supplementary reports on issues related to Cybersecurity readiness.


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer, Information Technology Officer and Chief Risk Officer. Together with the Bank's Electronic Data Processing (EDP) Committee, comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security and Information Technology Officers of the Bank work to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors receives training annually.


text: The Bank engages a third party to audit and examine its processes, conduct vulnerability assessments, and review the security of its network infrastructure consistent with FFIEC (Federal Financial Institutions Examination Council) Information Technology Audit guidelines, regulatory requirements and federal banking agency expectations. Trusted third parties are engaged to assist the Bank in improving its cybersecurity readiness. The Bank engages third party vendors to monitor and assist in maintaining its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by a specialized vendor that assists the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.


text: Although the Company and Bank have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected their business strategy, results of operations or financial condition, there can be no guarantee that the Company or Bank will not experience such an incident in the future.


text: Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.

companyName: DevvStream Corp.

ticker: DEVS


text: We have implemented an information security management system in accordance with our risk profile and business that is designed to protect the Company, our employees, and our shareholders from cybersecurity threats. We have also developed an incident response policy and procedure designed to facilitate the handling of cybersecurity incidents.


text: Our cybersecurity risk management program seeks to proactively identify, assess, and mitigate risks from cybersecurity threats. Key components include informal self-assessments, third-party managed security services, malware protection, and network security controls. We also maintain a cyber insurance policy that provides coverage for certain costs and liabilities associated with cybersecurity incidents, including data breaches and network interruptions; however, such insurance may not be sufficient to cover all losses in every circumstance.


text: We take a risk-based approach to the evaluation and oversight of third-party vendors with access to Company systems or data.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and cybersecurity incidents that could affect our information or systems. For more information, see Item 1A. Risk Factors.


text: Oversight of Cybersecurity Risk Management Oversight of cybersecurity risk is the responsibility of the Board of Directors as part of its broader role in overseeing the Company's enterprise risk management framework. The Board receives periodic updates from management regarding cybersecurity matters, including the Company's information security program, risk assessments, and incident response preparedness.


text: The Board delegates certain aspects of enterprise risk oversight to its committees as appropriate; however, cybersecurity risk management is primarily monitored at the full Board level. The Board regularly reviews management's assessment of cybersecurity risks, key controls in place to mitigate those risks, and the Company's overall cyber readiness.


text: Management is responsible for implementing and maintaining the Company's cybersecurity policies, programs, and controls, and for reporting to the Board on material developments and significant incidents. Updates to the Board occur at least annually and more frequently as needed in the event of notable changes in the threat environment or incidents requiring attention.


text: The Company maintains a comprehensive risk management program designed to assess, identify, and manage material risks facing the Company, including material risks associated with cybersecurity risks and vulnerabilities. Through this risk management program, the Company seeks to mitigate the potential impact of any cybersecurity incidents on the Company's operations and financial condition. We have a comprehensive set of processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Implementation of cybersecurity measures, such as firewalls, endpoint intrusion detection and response systems, and anti-virus/anti-malware software. Employee training and awareness programs to educate all employees about cybersecurity threats, incident reporting and prevention measures. Monitoring of network traffic and information technology systems for signs of potential threats.

companyName: JANEL CORP

ticker: JANL


text: Incident response plan to ensure swift, effective and accurate disclosure of cybersecurity incidents to the appropriate employees of the Company, as well as our Board of Directors, if applicable.


text: We engaged a third-party expert in January 2021 for the development of our information technology ("IT") risk management program, which included the development of a common framework for assessing and mitigating IT risks for the Company. The framework included a specific cybersecurity category to address measures to protect the Company from malware, ransomware and phishing, among others. The outcome was the creation of Company IT narratives and an IT risk control matrix. We regularly work with a third-party expert to test and update our risk mitigation controls.


text: As of the date of this annual report, we are not aware of any cybersecurity incidents that have had, or are reasonably likely to have, a materially adverse effect on our operations, business, results of operations, or financial condition. As discussed more fully under "Item 1A—Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See "Item 1A—Risk Factors—Security breaches or cybersecurity attacks may have a material adverse effect on Janel's ability to operate, could result in personal information being misappropriated and may cause Janel to be held liable or suffer harm to its reputation" and "—Our inability to successfully recover should we experience a catastrophic event, disaster or other business continuity problem could cause material financial loss, loss of human capital, regulatory actions, reputational harm or legal liability."


text: The Board of Directors maintains oversight of cybersecurity risk primarily through its Audit Committee. The Audit Committee receives regular updates from management on cybersecurity risks and incidents and the overall effectiveness of our cybersecurity programs.


text: The Company conducts quarterly meetings of the IT and financial leadership of the Company's segments, including the CFO, and information from those meetings is provided to the Company's Audit Committee, which typically meets on a quarterly basis. At each Audit Committee meeting, the CFO provides an update to the Audit Committee on any relevant current and new IT risks and the general health of the IT risk management program, including cybersecurity risks. The CFO also provides the Audit Committee with a quarterly written cybersecurity brief from IT leadership, including an incident reporting log, a review of emerging cybersecurity risks and developments, an assessment of the overall effectiveness of our cybersecurity programs and recommended updates to our cybersecurity risk assessment program. Management, along with our CFO, is responsible for developing the cybersecurity strategy and supervising our cybersecurity risk management program. Our IT team supports these efforts by managing day-to-day operations, including threat detection, incident response and system monitoring. Our cybersecurity incident reporting and escalation plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior Company management and our Audit Committee and/or Board of Directors, as applicable.


text: We take cybersecurity threats seriously. We have developed and implemented processes to assess, identify and manage material risks from cybersecurity threats. These cybersecurity processes are a part of our overall enterprise risk management system, sharing governance processes and reporting structures with other components of our enterprise-wide risk management system. Our cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, Company-wide employee training. Our cybersecurity processes also extend to the oversight and identification of risks associated with our vendors and customers if their computer systems interface with our information systems. Upon detection of a potentially material cybersecurity incident, we will activate our cyber incident procedure to investigate, contain and remediate the incident. Depending on the extent and severity of the incident, we may engage third-party cybersecurity consultants to assist with our cyber incident procedure. Risks from cybersecurity threats have the potential to materially affect us, including our results of operations and financial condition.

companyName: JOHNSON OUTDOORS INC

ticker: JOUT


text: The Company has established an Enterprise Risk Committee, which is co-chaired by the Company's Chief Financial Officer and Senior Managing Director of Legal Affairs, and under that framework has chartered a Cybersecurity Sub-Committee, chaired by the Chief Technology Officer. Both committees include various other members of key senior management. Our Board of Directors (including our Audit Committee through delegation as described below), along with our Enterprise Risk Committee and Cybersecurity Sub-Committee, are actively involved in providing oversight of our cybersecurity program. The role of the Board of Directors in the Company's risk oversight process includes receiving reports and presentations from the Enterprise Risk Committee or other senior management leaders on areas of material risk to the Company, including operational, financial, legal and regulatory, strategic, reputational, cybersecurity and Environmental, Social and Governance ("ESG") related risks and any measures taken to mitigate such risks. In addition, the Board of Directors regularly reviews and discusses areas of material risk at its meetings. In essence, the Board of Directors oversees a company-wide approach to risk management, carried out by Company management. With respect to cybersecurity risk, the Board (through the Audit Committee) periodically reviews information on management's policies and processes related to the Company's cybersecurity and data-protection measures, including related to monitoring, controlling and mitigating against such risks, and the entire Board receives periodic updates on the Company's cybersecurity risk management processes. There have been no material cybersecurity incidents in the periods presented in this Report.


text: Risk Management Strategy Securing the Company's business information, customer, supplier, and employee data and information technology systems is an important part of our overall risk management framework. We rely on certain key information technology systems, some of which are dependent on services provided by third parties, including cloud vendors, for various business functions necessary to operate and manage our business. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including a review of SOC-1 reports on an annual basis.

companyName: PHOTRONICS INC

ticker: PLAB


text: We have adopted processes, guided by the Center for Internet Security (CIS) Cybersecurity Framework, designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. We have implemented controls, such as Multi-Factor Authentication (MFA) and endpoint detection and response (EDR) solutions, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. Furthermore, we maintain a formal, Incident Response Plan (IRP) and conduct mandatory, ongoing security awareness training for all employees. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has ultimate responsibility for the oversight of risk management, including risks from cybersecurity threats. The Board of Directors has delegated primary oversight of cybersecurity risk to the Cyber Security Risk Management Committee. The Committee, in turn, ensures its members either possess or have access to relevant cybersecurity and risk management expertise to effectively challenge and guide management's program. The Committee regularly assesses how management is managing these risks and reports on its activities to the full Board of Directors at least quarterly to promote effective coordination and ensure the entire Board remains apprised of the cybersecurity risk landscape and the program's effectiveness.


text: The day-to-day cybersecurity program is led by the Company's Vice President, IT Infrastructure & Information Security. This role is supported by a dedicated security team and reports directly to the Chief Executive Officer. The Vice President, IT Infrastructure & Information Security provides formal, quarterly updates to the Cyber Security Risk Management Committee. These updates cover cyber risk management governance, the status of ongoing efforts to strengthen cybersecurity effectiveness, key risk metrics and the material outcomes of risk assessments, and significant cybersecurity-related news events impacting the industry. In addition to scheduled reports, the Board of Directors engages in ad hoc conversations with management to discuss any significant updates to our cybersecurity risk management and initiatives, particularly in response to emerging threats.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in depth, layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected persistent threats. Notwithstanding the strength of our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third party service providers are under constant threat, creating the possibility of future events. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology based products and services by us and our customers.


text: The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, and are managed and monitored by a dedicated information technology team, which is led by our Director of Information Technology, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers.


text: We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their estimated impact on the Company's risk environment.


text: Our Director of Information Technology, who reports to the Chief Financial Officer, has over 15 years of experience managing information technology and cybersecurity matters and is experienced in cloud, infrastructure management, business operations, and cybersecurity, and, together with our Information Technology Steering Committee, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including those resulting from prior cybersecurity incidents, that have materially affected us, and we face ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors." under the heading "Systems failures, interruptions and cybersecurity breaches in our information technology and telecommunications systems and of third-party service providers could have a material adverse effect on us."


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level committee designated by our Board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Bank's cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board receives an Annual Report from the Director of Information Technology on the Bank's Information Technology Systems, including cybersecurity risk.


text: As one of the largest global pharmaceutical sourcing and distribution services companies engaged in helping both healthcare providers and pharmaceutical and biotechnology manufacturers, we are exposed to various cybersecurity threats. These threats include both those typical of companies operating in many industries, like ransomware and denial-of-service attacks, as well as more sophisticated and persistent threats from highly organized adversaries that specifically target the healthcare sector and other critical infrastructure. Our suppliers, third-party vendors, service providers, customers, and other business partners (collectively, our "third-party business partners") are also vulnerable to similar cybersecurity risks, and any cyber incident affecting us and/or our third-party business partners could significantly disrupt our operations. In light of these risks, cybersecurity is a priority for the Company, management, and our Board of Directors (the "Board"), and we believe that it is essential for us to invest substantial resources in our cybersecurity efforts.

companyName: Cencora, Inc.

ticker: COR


text: Cybersecurity risk management is integral to our enterprise risk management strategy. Our management, with involvement and input from external consultants and advisors, and oversight from our Board, regularly performs an enterprise-wide risk assessment to identify key existing and emerging risks.


text: To oversee cybersecurity risk at the management level, we employ a Chief Data and Information Officer ("CDIO") and a Chief Information Security Officer ("CISO"). The CDIO is responsible for the global data landscape and IT systems across our business units, including information security. The CISO leads our Information Security team. The CISO and his team are responsible for administering our comprehensive, company-wide information security program, which includes strategy, regulatory intelligence, IT risk management, policy development, security engineering, cyber threat detection, response, and operations. Our information security program is based upon, informed by, and responsive to industry best practice frameworks such as HITRUST CSF and ISO 27001. Our program undergoes an internal annual review that is conducted by our CISO, as well as an annual third-party external review. Additionally, we leverage a diverse array of internal and external assessors, consultants, auditors, and other third parties to identify opportunities for improvements to our information security program through methods such as penetration testing, independent audits, and consulting on best practices to address emerging risks and challenges. These assessments encompass evaluations of both the design and operational effectiveness of our security measures. Additionally, we are a member of H-ISAC, an industry cybersecurity intelligence and risk-sharing organization, which enables us to stay informed about developments, trends, and risks in the cybersecurity threat landscape and consider any necessary updates to our information security program related thereto. We are committed to employing cybersecurity best practices and have obtained and maintain multiple industry best practice cybersecurity certifications such as ISO 27001and SOC1/SOC2.


text: Under the leadership of our CDIO and CISO, and with oversight, as appropriate, from the Board's Audit Committee, we have developed a Cybersecurity Incident Response Process (the "Response Process"), which sets forth a detailed and comprehensive framework for the actions to be taken in response to a cybersecurity incident and includes appropriate escalations to the Company's senior management, including our ECCRT (as defined below), and the Board. Under the guidance of our CISO, the Response Plan is routinely evaluated and updated as appropriate. In addition to our Response Plan, which is employed in the event of a cybersecurity incident, we take preventative measures that are designed to mitigate the likelihood and prevalence of cybersecurity incidents. For example, we believe that enterprise-wide cybersecurity and privacy training serve an important role in risk reduction. Accordingly, we require employees to complete periodic access-based and role-based privacy and cybersecurity training. These trainings are routinely updated to reflect changes in the threat environment, assessment, and/or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.


text: We recognize that our cybersecurity risk profile extends beyond our organization. As such, we strive to manage cybersecurity risks associated with our third-party business partners and external users of our systems. Our third-party business partner risk management program is built upon, informed by, and responsive to industry best practices. This program is designed to conduct appropriate due diligence on the third-party business partners with whom we engage and conduct business, as well as on the systems and the cybersecurity controls of such third-party business partners. Specifically, to evaluate third-party cybersecurity controls, we utilize third-party cybersecurity monitoring and alerting tools, cybersecurity due diligence questionnaires, and request and review third-party audit reports and assurance certifications if they exist.


text: Our information systems have been subject to cybersecurity incidents in the past, including the incident disclosed in February 2024 relating to certain exfiltrated data. The incident has not had a material impact on the Company's operations and, as previously disclosed, we do not believe that the incident is reasonably likely to materially impact our financial condition or results of operations. However, there is no guarantee that future cybersecurity incidents will not have a material impact. Despite our comprehensive approach to cybersecurity, we may not be able to prevent or mitigate a cybersecurity incident that could materially impact our business, results of operations, or financial condition. While we hold cybersecurity insurance, the expenses associated with cybersecurity threats or disruptions may not be completely covered by our policy. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.


text: Board Governance and Management As described above, our CDIO leads management's assessment and management of cybersecurity with the assistance of our CISO, who reports directly to the CDIO and meets with the CDIO on a regular basis to discuss pertinent risks, mitigation factors, remediation status, and risk acceptance. The CDIO, who reports directly to our President and Chief Executive Officer, is a member of the Executive Leadership Team (the "ELT") and provides updates to the ELT about cybersecurity matters. Our CDIO has more than 25 plus years of experience managing technology and risks and advising on cybersecurity issues, and our CISO has more than 25 plus years of IT and relevant cybersecurity experience.


text: Additionally, we have established the Extended Cyber Crisis Response Team ("ECCRT"). The ECCRT is a cross-functional incident response team comprised of senior leaders from across the various departments of the organization that, in the event of a cyber incident, helps lead the decision-making process for the execution of containment and recovery processes and incident communications, including reporting to senior management and, in turn, the Board, as appropriate, in each case in accordance with the protocols set forth in our Response Process.


text: Cybersecurity is among the risks identified by our Enterprise Risk Management Team for Board-level oversight. While the full Board retains overall oversight over cybersecurity, the Board has delegated to its Audit Committee oversight of the Company's information technology security program and the controls around cybersecurity and to its Compliance and Risk Committee oversight of an enterprise risk management program that is designed to assist with monitoring and mitigating operational risks. The Audit Committee and Compliance and Risk Committee meet every quarter. The Audit Committee is updated as needed on cybersecurity threats, incidents, and programs, and the Compliance and Risk Committee is updated as needed on new developments in our cybersecurity risk profile. After each such meeting, the respective chairs of the Audit Committee and Compliance and Risk Committee provide a report to the full Board on the committee meeting.


text: Senior leadership, including our CDIO and CISO, routinely update and report to the Board, the Audit Committee, and the Compliance and Risk Committee, as applicable, on our cybersecurity and information security risks and the management of such risks, our data governance and usage, our technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.


text: As one of the largest global pharmaceutical sourcing and distribution services companies engaged in helping both healthcare providers and pharmaceutical and biotechnology manufacturers, we are exposed to various cybersecurity threats. These threats include both those typical of companies operating in many industries, like ransomware and denial-of-service attacks, as well as more sophisticated and persistent threats from highly organized adversaries that specifically target the healthcare sector and other critical infrastructure. The emergence of artificial intelligence has provided additional tools for those who perpetrate these attacks, including through social engineering, the development of customized malware, and an enhanced ability to evade detection. Our suppliers, third-party vendors, service providers, customers, contractors, those who work for our contractors, and other business partners (collectively, our "third-party business partners") are also vulnerable to similar cybersecurity risks, and any cyber incident affecting us and/or our third-party business partners could significantly disrupt our operations. In light of these risks, cybersecurity is a priority for the Company, management, and our Board of Directors (the "Board"), and we believe that it is essential for us to invest substantial resources in our cybersecurity efforts.


text: To oversee cybersecurity risk at the management level, we employ a Chief Data and Information Officer ("CDIO") and a Chief Information Security Officer ("CISO"). The CDIO is responsible for the global data landscape and IT systems across our business units, including information security. The CISO leads our Information Security team. The CISO and his team are responsible for administering our comprehensive, company-wide information security program, which includes strategy, regulatory intelligence, IT risk management, policy development, security engineering, cyber threat detection, response, and operations. Our information security program is based upon, informed by, and responsive to industry best practice frameworks such as HITRUST CSF and ISO 27001. Our program undergoes an internal annual review that is conducted by our CISO, as well as an annual third-party external review. Additionally, we leverage a diverse array of internal and external assessors, consultants, auditors, and other third parties to identify opportunities for improvements to our information security program through methods such as penetration testing, independent audits, and consulting on best practices to address emerging risks and challenges. These assessments encompass evaluations of both the design and operational effectiveness of our security measures. They also consider the evolution of different cybersecurity threats, including through artificial intelligence. Additionally, we are a member of H-ISAC, an industry cybersecurity intelligence and risk-sharing organization, which enables us to stay informed about developments, trends, and risks in the cybersecurity threat landscape and consider any necessary updates to our information security program related thereto. We are committed to employing cybersecurity best practices and have obtained and maintain multiple industry best practice cybersecurity certifications such as ISO 27001and SOC1/SOC2.


text: Under the leadership of our CDIO and CISO, and with oversight, as appropriate, from the Board's Audit Committee, we have developed a Cybersecurity Incident Response Process (the "Response Process"), which sets forth a framework for the actions to be taken in response to a cybersecurity incident and includes appropriate escalations to the Company's senior management, including our ECCRT (as defined below), and the Board. Under the guidance of our CISO, the Response Process is routinely evaluated, tested and updated as appropriate. In addition to our Response Process, which is employed in the event of a cybersecurity incident, we take preventative measures that are designed to mitigate the likelihood and prevalence of cybersecurity incidents. For example, we believe that enterprise-wide cybersecurity and privacy training serve an important role in risk reduction. Accordingly, we require employees to complete periodic access-based and role-based privacy and cybersecurity training. These trainings are routinely updated to reflect changes in the threat environment, assessment, and/or audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns.


text: We recognize that our cybersecurity risk profile extends beyond our organization. As such, we strive to manage cybersecurity risks associated with our third-party business partners and external users of our systems. Our third-party business partner risk management program is built upon, informed by, and responsive to industry best practices. This program is designed to conduct appropriate due diligence on the third-party business partners with whom we engage and conduct business, as well as on the systems and the cybersecurity controls of such third-party business partners. Specifically, to evaluate third- party cybersecurity controls, we utilize third-party cybersecurity monitoring and alerting tools, cybersecurity due diligence questionnaires, and request and review third-party audit reports and assurance certifications if they exist.


text: Our information systems have been subject to cybersecurity incidents in the past. To date, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect us. However, there is no guarantee that future cybersecurity incidents will not have a material impact. Despite our comprehensive approach to cybersecurity, we may not be able to prevent or mitigate a cybersecurity incident that could materially impact our business, results of operations, or financial condition. While we hold cybersecurity insurance, the expenses associated with cybersecurity threats or disruptions may not be completely covered by our policy. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.


text: Board Governance and Management As described above, our CDIO leads management's assessment and management of cybersecurity with the assistance of our CISO, who reports directly to the CDIO and meets with the CDIO on a regular basis to discuss pertinent risks, mitigation factors, remediation status, and risk acceptance. The CDIO, who reports directly to our President and Chief Executive Officer, is a member of the Enterprise Leadership Team (the "ELT") and provides updates to the ELT about cybersecurity matters. Our CDIO has more than 25 plus years of experience managing technology and risks and advising on cybersecurity issues, and our CISO has more than 20 plus years of IT and relevant cybersecurity experience.


text: Additionally, we have an Extended Cyber Crisis Response Team ("ECCRT"), which is a cross-functional team comprised of senior leaders that, in the event of a cyber incident, help lead the decision-making process for the execution of containment and recovery processes and incident communications, including reporting to senior management and, in turn, the Board, as appropriate, in each case in accordance with the protocols set forth in our Response Process.


text: Cybersecurity is among the risks identified by our Enterprise Risk Management Team for Board-level oversight. While the full Board retains overall oversight over cybersecurity, the Board has delegated to its Audit Committee oversight of the Company's information technology security program and the controls around cybersecurity, and to its Compliance and Risk Committee oversight of an enterprise risk management program that is designed to assist with monitoring and mitigating operational risks. The Audit Committee and Compliance and Risk Committee meet every quarter. The Audit Committee is updated as needed on cybersecurity threats, incidents, and programs, and the Compliance and Risk Committee is updated as needed on new developments in our cybersecurity risk profile. After each such meeting, the respective chairs of the Audit Committee and Compliance and Risk Committee provide a report to the full Board on the committee meeting.


text: How management is informed of and monitors incidents Our management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity programs. Our cybersecurity programs are under the direction of our CSO (in coordination with our Chief Privacy and Data Responsibility Officer, Chief Data Officer, among others), who receives reports from our cybersecurity teams and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our management, including the CSO and our cybersecurity teams, follow a risk-based escalation process to notify the Risk Committee outside of the regular reporting cycle as appropriate when they identify an emerging risk or material issue.

companyName: Mastercard Inc

ticker: MA


text: Reporting to our Board Given the importance of information security and privacy to our stakeholders, our Board receives an annual report from our CSO to discuss our program for managing information security risks, including cyber and data security risks. The Risk Committee also receives periodic briefings on data privacy from the Chief Privacy and Data Responsibility Officer. Our Risk Committee receives regular reports on our cyber readiness, our risk profile status, our cybersecurity programs, material cybersecurity risks and mitigation strategies, third-party assessments of our cybersecurity program and other cybersecurity developments. The Risk Committee chair provides reports to the Board on such topics. In addition, our Board and the Risk Committee also receive information about these topics as part of regular business and legal and regulatory updates. In addition, we engage directors as part of cybersecurity and data breach incident simulations.


text: Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. See "Risk Factors – Information Security and Operational Resilience" in Part I, Item 1A for more information about these and other risks related to information security.


text: AMN Healthcare's board of directors (the "Board") is responsible for overseeing our enterprise-wide risk management program. The audit committee of the Board (the "Audit Committee") has primary oversight responsibility for information security and cybersecurity, including internal controls designed to mitigate risks related to these topics. This includes regular, and at least quarterly, review by the Audit Committee of reports on topics including, among others, significant cybersecurity risks results from third-party assessments, training and vulnerability testing, and our incident response plan. Material breaches, if any, and any disclosure obligations arising from any such breach are also discussed during separate Audit Committee meetings as part of the Boards' risk oversight generally.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: AMN's information security program reports up to our Chief Information & Digital Officer ("CIO") and is managed by our Senior Director, Information Security, whose team is responsible for leading our enterprise-wide cybersecurity strategy. Through ongoing communications with the team, the CIO and the Senior Director, Information Security, are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity infrastructure initiatives. In the event of a material cybersecurity incident, the CIO will escalate to the Audit Committee and the Board is made aware as appropriate and in accordance with AMN's incident response plan. Our CIO and Senior Director, Information Security have proven experience as technology leaders establishing and overseeing enterprise information security programs in the healthcare industry. Our CIO has over 25 years of experience serving as Chief Information Officer, Senior Vice President of IT, and Director of IT at various healthcare services and technology companies. AMN's Senior Director, Information Security has over 20 years of experience in various roles in information technology and information security. He holds a M.Sc. in Computer Information Systems and holds several relevant certifications, including Certified Information Security Manager and Zero Trust Certified Architect.


text: AMN's Privacy function, which reports up through our Chief Legal Officer, works collaboratively with the Information Security function and to create and review policies, standards and processes. In addition to updating the Audit Committee, the CIO and Senior Director, Information Security, and Privacy team provide regular updates to our Chief Executive Officer and other members of our senior management as appropriate.


text: AMN's information security program has adopted policies, standards, processes, and practices that follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization, and other relevant standards. AMN Healthcare has also implemented certain controls and procedures that allow its management to assess, identify, and manage material risks from cybersecurity threats. Our processes are integrated into the overall enterprise risk management program, which includes financial risk, compliance risk and other strategic and operational risks that affect the Company. These processes complement our enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Board through its Audit Committee.


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We have developed an incident response plan to manage identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. The incident response plan sets forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. In addition to our in-house capabilities, we engage with key security and technology vendors, industry participants and intelligence communities to assess our program and test our technical capabilities and enhance the effectiveness of our information security policies and procedures. We use a combination of tools and technologies to protect AMN Healthcare and the personal information we maintain and operate a proactive threat intelligence program to identify and assess risk. We have also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party vendors, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data.


text: Our team members receive annual training to understand the behaviors necessary to protect company and personal information and receive annual training on privacy laws and requirements. We also offer ongoing practice and education for team members to recognize and report suspicious activity, including phishing campaigns.


text: The Company has experienced cyber threats resulting in immaterial cyber incidents and expects cyber threats to continue with varying levels of sophistication.


text: AMN Healthcare's board of directors (the "Board") is responsible for overseeing our enterprise-wide risk management program. The audit committee of the Board (the "Audit Committee") has primary oversight responsibility for information and cybersecurity, including internal controls designed to mitigate risks related to these topics. This includes regular, and at least quarterly, review by the Audit Committee of reports on topics including, among others, significant cybersecurity risks, results from third-party assessments, training and vulnerability testing, and our incident response plan. Material breaches, if any, and any disclosure obligations arising from any such breach are also discussed separately with the Audit Committee as part of the Board's risk oversight generally.


text: AMN's information and cybersecurity program reports up to our Chief Information & Digital Officer ("CIO") and is managed by our Vice President, Information & Cyber Security, whose team is responsible for leading our enterprise-wide cybersecurity strategy. Through ongoing communications with the team, the CIO and the Vice President, Information & Cyber Security, are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity infrastructure initiatives. In the event of a material cybersecurity incident, the CIO, in coordination with AMN's Chief Legal Officer, will escalate to the Audit Committee and the Board is made aware as appropriate and in accordance with AMN's incident response plan. Our CIO and Vice President, Information & Cyber Security have proven experience as technology leaders establishing and overseeing enterprise information security programs in the healthcare industry. Our CIO has over 25 years of experience serving as Chief Information Officer, Senior Vice President of IT, and Director of IT at various healthcare services and technology companies. AMN's Vice President, Information & Cyber Security has over 20 years of experience in various roles in information technology and information security. He holds a M.Sc. in Computer Information Systems and holds several relevant certifications, including Certified Information Security Manager and Zero Trust Certified Architect.


text: AMN's Privacy function, which reports up through our Chief Legal Officer, works collaboratively with the Information Security function to create and review policies, standards and processes. In addition to updating the Audit Committee, the CIO and Vice President, Information & Security, and Privacy team provide regular updates to the Corporate Governance and Compliance Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate.


text: AMN's information and cybersecurity program has adopted policies, standards, processes, and practices that follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization, and other relevant standards. AMN Healthcare has also implemented certain controls and procedures that allow its management to assess, identify, and manage material risks from cybersecurity threats. Our processes are integrated into the overall enterprise risk management program, which includes financial risk, compliance risk and other strategic and operational risks that affect the Company. These processes complement our enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Board through its Audit Committee.


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and periodic tabletop exercises. We have developed an incident response plan to manage identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. The incident response plan sets forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. In addition to our in-house capabilities, we engage with key security and technology vendors, industry participants and intelligence communities to assess our program and test our technical capabilities and enhance the effectiveness of our information and cybersecurity policies and procedures. We use a combination of tools and technologies to protect AMN Healthcare's assets and information. We maintain and operate a proactive threat intelligence program to identify and assess risk. We have implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party vendors, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data.