text: A primary element of our cybersecurity program is the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including to monitor compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our cybersecurity program is designed based on the concepts of control maturity and control efficacy. For control maturity, our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and is assessed annually by an independent third party against our yearly control maturity targets in the context of current cyber threat and industry trends. The NIST CSF assessment results are used to validate the progress made against the current year maturity targets, inform the program's strategic priorities and establish maturity targets for the following year. These assessment results are provided to our Audit Committee and our Board of Directors on an annual basis.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG

secItem: Item 1C


text: For control efficacy, the cybersecurity program leverages a variety of metrics and measurements to demonstrate whether the control objectives are being consistently achieved within the target range. Monthly security operation (SecOps) reviews are utilized to monitor metric trends and root causes to determine potential capability improvements. The monthly SecOps reviews and related actions are aggregated into a subset of key metrics reviewed quarterly by the Audit Committee.


text: Our Audit Committee oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Audit Committee receives an update from our CISO and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, penetration testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our CISO and our third-party cybersecurity consultant to review our cybersecurity strategy and the results of our NIST CSF assessment. In accordance with our cybersecurity incident response plan, our Board is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future. For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect the company, see our risk factors, including the risk factors titled "Our strategy includes an increasing dependence on technology in our operations. If any of our key technology fails, our business could be adversely affected." and "A cybersecurity incident could negatively impact our business and our relationships with customers." in Item 1A of this Annual Report on Form 10-K.


text: Republic's technology and cybersecurity programs are crucial to maintaining secure operations, which enable us to deliver on our promise to customers and maintain stakeholder trust. Our Cybersecurity organization, led by our Chief Information Security Officer (CISO), is responsible for establishing, implementing and executing our cybersecurity program and strategy. Our CISO has over 20 years of information technology, information technology audit, and cybersecurity experience, and is involved in assessing the latest developments in cybersecurity, including potential threats and innovative risk management techniques.


text: Our cybersecurity program is a critical component of our enterprise risk management process overseen by our Board of Directors, and we have integrated cybersecurity-related risks into our overall enterprise risk management framework. Additionally, cybersecurity-related risks are included in the risk universe that the risk management function evaluates to assess top risks to the enterprise on an annual basis.


text: Our Cybersecurity organization proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: a. A formal enterprise-wide cybersecurity policy and related standards; b. Cybersecurity training and employee phishing simulations; c. Scheduled and ad hoc internal and external penetration tests; d. Cyber incident response, IT disaster recovery, and business continuity plans; e. Cybersecurity assessments and remediation planning as part of our M&A due diligence process; f. Identity and access management controls;


text: g. Third-party risk assessment and management for vendors and third-party service providers; and h. Cyber incident tabletop exercises for our Board of Directors and management.


text: Our cybersecurity program is designed based on the concepts of control maturity and control efficacy. For control maturity, our cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is assessed annually by an independent third party against our yearly control maturity targets in the context of current cyber threat and industry trends. The NIST CSF assessment results are used to validate the progress made against the current year maturity targets, inform the program's strategic priorities and establish maturity targets for the following year. These assessment results are provided to our Audit Committee and our Board of Directors on an annual basis.


text: To effectively assess, identify, and manage material risks from cybersecurity threats, the Company maintains a cyber risk management program, which is led by our Chief Information Security Officer and Vice President of Infrastructure Services and Supply Chain Systems (the "CISO"). The CISO reports to the Senior Vice President and Chief Information Officer (the "CIO"), who in turn reports to the CFO.

companyName: CARTERS INC

ticker: CRI


text: The Company has implemented the following processes to assess, identify, and manage material risks from cybersecurity threats: • Annual assessments, by an independent third party, of the Company's cybersecurity framework under the National Institute for Standards and Technology ("NIST") cybersecurity framework; • Penetration tests conducted by a third-party; • Simulation of attacks on the Company's systems by third-parties to test the Company's systems and protections;


text: •"Table-top" simulation exercises involving the Company's management and its third-party consultants and advisors to simulate a cyber incident and the Company's response to that incident, pursuant to the Company's Incident Response Plan; and • Payment card industry ("PCI") audits to assess the Company's processing of credit card transactions pursuant to standards adopted by the PCI.


text: In addition, to mitigate material risks from cybersecurity threats, the Company has implemented various controls, including, but not limited to, the following: • Intrusion prevention controls (such as network segmentation and firewalls); • Access controls (such as identity and access management and multi-factor authentication on critical applications and systems); • Detection controls (such as endpoint threat detection and response, and logging and monitoring involving the use of a third-party for security information and event management, with reports and alerts provided by the third-party to the CISO's team); and • Threat protection controls (such as mandatory cyber-threat training and simulated phishing campaigns with employees, vendor management programs, and vulnerability and patch management).


text: The Company has integrated its processes for assessing, identifying, and managing material risks from cybersecurity threats into its overall risk management framework, including through coordination with the Company's internal leader of Enterprise Risk Management, and through quarterly reporting to the Company's Audit Committee. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, except as disclosed in the risk factor titled "Our systems, and those of our third-party vendors, contain personal information and payment data of our retail store and eCommerce customers, and other third parties could be breached, which could subject us to adverse publicity, costly government enforcement actions or private litigation, and expenses" in Part I, Item 1A, "Risk Factors".


text: The Company has also implemented processes for overseeing and identifying risks from cybersecurity threats associated with its use of third-party service providers. For example, the Company has implemented the following: • Vendor onboarding processes including a Privacy Impact Assessment and a Cyber Security and Compliance Questionnaire; and • Enrollment of each vendor in a third-party risk monitoring tool that alerts the CISO's team should that vendor's security posture change.


text: The Audit Committee of the Board of Directors oversees risks from cybersecurity threats, including through quarterly reports to the Audit Committee by the Company's CISO and CIO and, as needed, special reports to the Audit Committee and/or the Chairperson of the Audit Committee. The Audit Committee includes members with technology and cybersecurity experience and certifications, including a Committee member with over 28 years of experience working for Hewlett Packard Enterprise Company and a Committee member with a Computer Emergency Readiness Team ("CERT") Certificate in Cybersecurity Oversight issued by the CERT Division of the Software Engineering Institute at Carnegie Mellon University and completion of the National Association of Corporate Directors Master Course in Cybersecurity.


text: Management plays an integral role in assessing and managing the Company's material risk from cybersecurity risks. The assessment and management of those risks is led by the Company's CISO, who has over 20 years of experience working in information technology, including over 10 years specifically focused on information security, infrastructure, and strategy, and the Company's CIO, who has over 25 years of experience in Retail, Consumer Products, Merchandising, Supply Chain and IT, of which 15 years have been in leadership roles, and implemented by the CISO's team, who are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, processes and operations. The CISO and CIO lead quarterly meetings of the Company's Security Executive Steering Committee (the "Steering Committee"), which is composed of the Company's CFO, General Counsel, and CIO. The Steering Committee drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.


text: The Company's management maintains and implements a written Incident Response Plan, which is reviewed and updated on an annual basis and includes an Incident Response Plan Executive Committee consisting of the Company's CIO, CISO, and General Counsel. In addition, members of the CISO's and CIO's teams monitor the Company's systems and processes and promptly report incidents as required under the Incident Response Plan, including, but not limited to, reporting to the appropriate members of management and, as needed, the Audit Committee.


text: The Incident Response Plan has been developed to align with the four phases for the security handling lifecycle set forth in the National Institute for Standards and Technology Special Publication 800-61: (1) Preparation, (2) Detection & Analysis, (3) Containment Eradication & Recovery, and (4) Post-Incident Activity.


text: To effectively assess, identify, and manage material risks from cybersecurity threats, the Company maintains a cyber risk management program, which is led by our Chief Information Security Officer and Vice President of Infrastructure Services and Supply Chain Systems (the "CISO"). The CISO reports to the Executive Vice President, Chief Information & Technology Officer (the "CITO"), who in turn reports to the CEO.


text: The Company has implemented the following processes to assess, identify, and manage material risks from cybersecurity threats: • Annual audits, by an independent third party, of the Company's cybersecurity framework under the National Institute for Standards and Technology ("NIST") cybersecurity framework; • Penetration tests conducted by a third-party; • Simulation of attacks on the Company's systems by third-parties to test the Company's systems and protections;


text: The Company has integrated its processes for assessing, identifying, and managing material risks from cybersecurity threats into its overall risk management framework, including through coordination with the Company's internal leader of Enterprise Risk Management, and through quarterly reporting to the Company's Audit Committee. Cybersecurity threats, including as a result of any previous cybersecurity incidents incurred either by us or third parties, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, except as disclosed in the risk factor titled "Our systems, and those of our third-party vendors, contain personal information and payment data of our retail store and eCommerce customers, and other third parties could be breached, which could subject us to adverse publicity, costly government enforcement actions or private litigation, and expenses" in Part I, Item 1A, "Risk Factors".


text: T he Audit Committee of the Board of Directors oversees risks from cybersecurity threats, including through quarterly reports to the Audit Committee by the Company's CISO and CIO and, as needed, special reports to the Audit Committee and/or the Chairperson of the Audit Committee. The Audit Committee includes members with technology and cybersecurity experience and certifications, including a Committee member with over 28 years of experience working for Hewlett Packard Enterprise Company and a Committee member with a Computer Emergency Readiness Team ("CERT") Certificate in Cybersecurity Oversight issued by the CERT Division of the Software Engineering Institute at Carnegie Mellon University and completion of the National Association of Corporate Directors Master Course in Cybersecurity.


text: Management plays an integral role in assessing and managing the Company's material risk from cybersecurity risks. The assessment and management of those risks is led by the Company's CISO, who has over 20 years of experience working in information technology, including over 10 years specifically focused on information security, infrastructure, and strategy, and the Company's CIO, who has over 30 years of experience in Retail, Consumer Products, Merchandising, and IT, of which 16 years have been in leadership roles, and implemented by the CISO's team, who are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, processes and operations. The CISO and CIO lead quarterly meetings of the Company's Security Executive Steering Committee (the "Steering Committee"), which is composed of the Company's CFO, General Counsel, and CIO. The Steering Committee drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.


text: We rely on our information technology ("IT") and operational technology ("OT") systems, as well as systems of third-party vendors, to conduct our business. These systems are subject to possible cybersecurity threats. Cyberattacks are becoming more sophisticated, and U.S. government warnings have indicated that infrastructure assets, including pipelines and related infrastructure, may be specifically targeted by certain groups. These attacks include, without limitation, malicious software, ransomware, attempts to gain unauthorized access to data, and other electronic security breaches. Cybersecurity threats, which could increase as a result of geopolitical events, may be perpetrated by state-sponsored groups, "hacktivists," criminal organizations, private individuals and others.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: We consider the risks from cybersecurity threats to include, without limitation, disruptions to our business operations, theft of protected information or intellectual property, destruction of our control systems and data, losses from remedial actions, damage to our reputation, and exposure to lawsuits and regulatory actions. In general, such risks are based on the capabilities and intent of known bad actors as well as threat information gathered from multiple sources, including industry groups, government agencies, publications and third-party service providers. Our processes for managing these risks generally involve (i) the use of tools and technologies to continuously monitor for and identify system vulnerabilities and attacks; (ii) adherence to policies and procedures designed to protect our critical IT and OT systems; (iii) the use of an employee awareness program to promote cybersecurity education and company-wide support; and (iv) periodic reassessment of areas of focus to maintain continued preparedness relative to changes in tools and technologies as well as emerging threats.


text: Our processes for identifying, assessing and managing the risks from cybersecurity threats are a key component of our overall cybersecurity strategy, which is designed to safeguard technology critical to providing services for our customers, and protecting business-sensitive and personal information that is entrusted to us. To help execute our cybersecurity strategy, we have adopted a risk-based, layered, defense-in-depth approach, which, among other measures, includes: (i) the segregation of our critical industrial control systems (Operational Technology or OT systems) from our corporate network; (ii) multiple layers of preventative and detective measures; (iii) a cybersecurity incident response plan to promote preparedness; and (iv) a cross-functional cybersecurity steering committee (the "Cybersecurity Committee") to provide guidance around cybersecurity risk management. Our overall cybersecurity program is based on various industry-recognized frameworks and standards developed and issued by leading international, domestic and energy-industry standard-setting organizations.


text: As part of our overall cybersecurity strategy, we also engage third-party service providers to: (i) assist in our cybersecurity risk assessment procedures; (ii) perform penetration testing on external facing IT systems; (iii) perform security assessments on our IT and OT systems; (iv) assist in our incident response procedures; and (v) share information on industry-specific cybersecurity threats. With respect to our use of third-party systems, we oversee our risks from cybersecurity threats by working with our third-party vendors to evaluate their cybersecurity program for alignment with our own policies and procedures, including notification of and coordination during any incidents that might affect us.


text: To the extent our processes for overseeing risks are effective in eliminating cybersecurity threats or mitigating the impact of an unforeseen incident, we generally do not expect these risks to have a material impact on our business strategy, financial position, or results of operations. However, as mentioned in Part I, Item 1A. Risk Factors, we do not carry insurance specifically for cybersecurity incidents. If we were to incur a significant liability for which we were not fully insured, it could have a material adverse effect on our financial position, results of operations and cash flows.


text: For information on the risks we face from cybersecurity threats, please see the risk factors included under Part I, Item 1A titled " A cyber-attack on our IT or OT systems could affect our business and assets, and have a material adverse effect on our financial position, results of operations and cash flows. " and " Failure of our critical IT or OT systems could have an adverse impact on our business, financial condition, results of operations and cash flows, as well as our ability to pay cash distributions. "


text: Our Cybersecurity Committee is comprised of senior representatives from our legal, IT and OT, engineering, corporate security, risk, human resources, finance, accounting, public relations, investor relations and executive management teams. This committee plays a key role in assessing and managing our risks from cybersecurity threats. In particular, our Cybersecurity Committee is responsible for: (i) establishing and promoting company-wide support for the management of cybersecurity risk; (ii) providing oversight and ensuring alignment between our cybersecurity strategy and business objectives; (iii) reviewing and advising on cybersecurity policy and governance; (iv) providing a forum for review of cybersecurity risk in alignment with our business objectives and risk tolerance; (v) promoting cross-company alignment of cybersecurity programs and actions; and (vi) reviewing our cybersecurity incident response plan ("CIRP"). Our Cybersecurity Committee meets at least quarterly with senior representatives from our cybersecurity team and outside experts to discuss cybersecurity threat updates, new cybersecurity regulations, cybersecurity projects and entity-wide results of cybersecurity preparedness initiatives. If a cybersecurity incident occurs, our Cybersecurity Incident Response Team, which includes several members of our Cybersecurity Committee, will oversee the execution of our CIRP.


text: Our Board has oversight of all material risks relevant to Enterprise, including those related to cybersecurity threats. To help keep our Board informed about such risks, senior representatives from our IT and OT department provide quarterly updates to our Board regarding significant developments in: (i) cyberattacks and other cybersecurity threats targeting critical infrastructure; (ii) governmental enforcement actions and investigations against cyber criminals; (iii) the regulatory landscape impacting the midstream energy industry; (iv) improvements to our cybersecurity programs, including our CIRP and related response procedures, and the progress of ongoing cybersecurity projects.


text: We recognize that effective cybersecurity governance is an on-going process, and thus, encourage those individuals with oversight responsibilities to stay abreast of emerging cybersecurity threats as well as pursue cybersecurity education opportunities. To this end, a number of our Cybersecurity Committee members, particularly the IT and OT representatives, hold one or more industry-recognized information security certifications such as the CISSP, CISM and CISA.


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the oversight of our board of directors. Our executive officers are senior Blackstone Real Estate professionals and our Manager is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Blackstone's Chief Security Officer, or CSO, and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations, or BXTI, and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan, the IRP, designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of our Manager or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer, or CTO, to develop and advance the firm's cybersecurity strategy, which applies to us.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO, Adam Fletcher, is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. Prior to his appointment as CSO in 2017, Mr. Fletcher was Blackstone's Deputy CSO. Before joining Blackstone in 2014, Mr. Fletcher led the International Security organization for Equifax from 2012 to 2014. Blackstone's CTO, John Stecher is a Senior Managing Director and head of BXTI. Mr. Stecher is responsible for all aspects of technology across Blackstone. Mr. Stecher also advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and externally managed companies, such as us, on technology-related matters. Before joining Blackstone in 2020, Mr. Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays. He was also a member of the Barclays Technology Management Committee. Prior to joining Barclays in 2017, Mr. Stecher held a variety of senior management and engineering roles across Goldman Sachs' capital markets and technology divisions.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO review Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: Our board of directors is responsible for understanding the primary risks to our business. The audit committee of our board of directors is responsible for reviewing our and our Manger's IT security controls with management and evaluating the adequacy of our and our Manager's IT security program, compliance and controls with management.


text: Blackstone's CSO reports to both our executive officers as well as our board of directors and/or the audit committee annually on cybersecurity matters, including risks facing us and our Manager and, as applicable, certain incidents. In addition to such annual reports, our board of directors and/or audit committee receive periodic updates from Blackstone on the primary cybersecurity risks facing us and our Manager and the measures we and our Manager are taking to mitigate such risks, as well as on changes to our and our Manager's cybersecurity risk profile or certain newly identified risks.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer, or CSO, and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations, or BXTI, and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to identify, track and treat cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations " in this Annual Report on Form 10-K.


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer, or CTO, to develop and advance the firm's cybersecurity program strategy, which applies to us.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. He has over 25 years of information security, technology and engineering experience, including having previously led the international security organization at a large credit bureau.


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. Our CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Our CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and externally managed companies, such as us, on technology-related matters.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO are responsible for the review of Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: We rely upon information technology (IT) networks and systems to process, transmit and store electronic information, and to manage or support a variety of critical manufacturing and business processes or activities. Additionally, we and certain of our third-party vendors collect and store personal or confidential information, including personally identifiable information, in connection with human resources operations and other aspects of our business. The secure operation of these information technology networks and systems and the proper processing and maintenance of this information are critical to our manufacturing and business operations.

companyName: Dauch Corp

ticker: DCH


text: We have developed and implemented robust processes for identifying, assessing and managing risks from cybersecurity threats. Cybersecurity risk is included in AAM's "Top Risks Assessment" under our enterprise risk management program as identified and monitored by our Risk Management Working Group. This group is comprised of leadership from the major functions within AAM and the enterprise risk management program includes the identification and continuous evaluation of the risks associated with the systems and information most critical to AAM and the processes and controls in place to protect the systems and information.


text: In addition, the AAM Information Security Council (ISC), comprised of leadership representatives from across the organization, meets periodically to discuss current threats and trends and the resulting information security initiatives and priorities. The ISC members provide support for policy changes and insights into how the information security team can most effectively educate, communicate, and support AAM. The ISC is led by AAM's Chief Information Security Officer (CISO), our frontline business leader with regard to cybersecurity risk management. AAM's CISO has been an IT professional in various capacities for over 25 years and maintains the following certifications: Certified CISO, Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Privacy Technologist.


text: Further, in support of our information security program, we utilize certain third-party service providers, primarily in the following capacities: 1) incident response partners that assist with performing incident simulations and who are available to assist in the event of an actual cybersecurity incident; 2) consultants to conduct penetration testing on AAM systems and certain third-party systems, as necessary; and 3) auditors to assist with testing IT controls and performing gap analysis over IT processes and procedures. AAM's CISO manages and monitors these third-party service provider relationships and works closely with AAM's information security, procurement, legal and internal audit departments to ensure proper evaluation and security assessment of critical third-party service providers and data processors.


text: Our Board of Directors and its committees play an active role in overseeing our key risks. Our cybersecurity risk management processes and strategy are governed by the Audit Committee of our Board of Directors. Management provides quarterly reports to the Audit Committee that include, among other items: 1) AAM's cybersecurity scorecard, which includes certain key performance indicators (KPIs) and provides quantitative measures of these KPIs; 2) industry security trends and outlook; 3) an update on AAM's security program and roadmap; 4) current quarter IT security accomplishments; and 5) IT security priorities for the following quarter. In addition, on an annual basis, management reports to the Audit Committee the results of our system availability and disaster recovery testing for AAM's enterprise systems, as well as the results of our incident response testing and corresponding action plans.


text: Although no cybersecurity incidents during the year ended December 31, 2023 had a material impact on our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See Item 1A. Risk Factors for additional discussion regarding AAM's IT and cybersecurity risks.


text: We have developed and implemented our Information Security Management System (ISMS), which includes robust processes for identifying, assessing and managing risks from cybersecurity threats. Cybersecurity risk is included in AAM's "Top Risks Assessment" under our enterprise risk management program as identified and monitored by our Risk Management Working Group. This group is comprised of leadership from the major functions within AAM and the enterprise risk management program includes the identification and continuous evaluation of the risks associated with the systems and information most critical to AAM and the processes and controls in place to protect the systems and information.


text: Our ISMS leverages comprehensive cybersecurity frameworks and standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Center for Internet Security (CIS) Critical Security Controls, the Trusted Information Security Assessment Exchange (TISAX) standard, and the International Organization for Standardization (ISO) 27001 standard for information security. Our ISMS is built upon a balance of people, processes and technologies comprised of, among other elements: 1) 24/7 security monitoring using internal and third-party resources; 2) security awareness and phishing testing; 3) periodic table-top and live-fire exercises; 4) high system availability and business continuity; and 5) comprehensive incident response and escalation plans.


text: Further, in support of our ISMS, we utilize certain third-party service providers, primarily in the following capacities: 1) incident response partners that assist with performing incident simulations and who are available to assist in the event of an actual cybersecurity incident; 2) third-party experts to conduct penetration testing on AAM systems and certain third-party systems, as necessary; and 3) leveraging third-party expertise to assist with testing IT controls and performing gap analysis over IT processes and procedures. AAM's Chief Information Security Officer (CISO) manages and monitors these third-party service provider relationships and works closely with AAM's information security, procurement, legal and internal audit departments to ensure proper evaluation and security assessment of critical third-party service providers and data processors.


text: The AAM Information Security Council (ISC), comprised of leadership representatives from across the organization, meets periodically to discuss current threats and trends and the resulting information security initiatives and priorities. The ISC members provide support for policy changes and insights into how the information security team can most effectively educate, communicate, and support AAM. The ISC is led by AAM's Chief Information Officer (CIO) and CISO, our frontline business leaders with regard to cybersecurity risk management. AAM's CIO has been an IT professional in various capacities for over 25 years and maintains the following certifications: Certified CISO, Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Privacy Technologist.


text: Although no cybersecurity incidents during the year ended December 31, 2024 had a material impact on our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See Item 1A. Risk Factors for additional discussion regarding AAM's IT and cybersecurity risks.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity threats when they occur.

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX


text: Our cybersecurity program is focused on the following key areas: • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, an endpoint protection platform system, anti-malware functionality, email filtering, url filtering and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats, as well as periodic decoy and honeypot testing, as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • Assessments of Third Party Service Providers. We regularly evaluate the cybersecurity policies, standards, processes and practices of our key third party service providers in order to effectively identify and address any vulnerabilities or other risks. • Incident Response and Recovery Planning. We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Collaborative Approach. We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our executive management and board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our executive management and board of directors oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. Our executive management and board of directors each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our executive management and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our vice president, information operations works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity threats in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our vice president, information operations monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to executive management when appropriate. Our vice president, information systems has served in such role since October 2021 and in various roles in information security and information technology for over 25 years.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company to date, including our business strategy, results of operation or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Data breaches and cyber-attacks could compromise our intellectual property or other sensitive information and cause significant damage to our business, reputational harm and financial loss."


text: Our cybersecurity program is strategically crafted to achieve the paramount goals of identifying, protecting, detecting, and responding to all potential risks and threats. Employing a defense-in-depth strategy, we proactively identify, investigate, and resolve vulnerabilities and security incidents in a timely manner.

companyName: SunOpta Inc.

ticker: STKL


text: Continuous improvement is integral to our cybersecurity approach. Regular assessments, conducted with the expertise of external security firms against international standards, allow us to quantify our program's effectiveness. The insights gained from these assessments serve as a foundation for continuous improvement efforts. Outcomes are reported to our Audit Committee for transparency and accountability. We rely on services from a variety of third-party providers to supply things such as cloud storage and networks. On an annual basis, we review these providers to assess their risk profiles. We rely on these third parties to have their own cybersecurity programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. SUNOPTA INC.


text: Despite facing directed attacks, our systems have withstood such challenges without material interruptions to our business operations. Recognizing the potential impact of significant disruptions, we remain steadfast in our commitment to fortify our systems against evolving threats. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. Refer to Item 1A "Risk Factors - Our business operations could be disrupted if our information technology systems fail to perform adequately or are breached."


text: Heading our cybersecurity program is our Chief Information Officer ("CIO"). Our CIO has over 30 years of experience in Software Engineering and Information Technology/Cybersecurity and is supported by skilled professionals from our Information Technology team. This seasoned team provides regular updates to our Enterprise Risk Management Steering Committee (the "ERM"), composed of our Chief Executive Officer, Chief Financial Officer, Chief Administrative Officer, and other members of our senior leadership. Our Audit Committee and Board of Directors receive regular reports from the ERM, as well as directly from our CIO on a quarterly basis. These reports cover various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Furthermore, our Board of Directors takes a proactive stance in overseeing our annual enterprise risk assessment. This comprehensive evaluation encompasses key risks, including those associated with security, technology, and cybersecurity threats, demonstrating our commitment to robust governance and risk management.


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. This cybersecurity policy is designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: The Company is in the process of establishing a cybersecurity policy which implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy encompasses the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy strategy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.


text: Cybersecurity threats haven't significantly impacted our operations, and we don't anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures. Please refer to Item 1A: Risk Factors for further insights into cyber attack-related risks.


text: The Chief Financial Officer will oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. The Audit committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.


text: We rely on information technology and data to operate our business and develop, market, and deliver our products to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, software, and our critical data includes confidential, personal, proprietary, and sensitive data, collectively our "Information Assets". Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: Leatt Corp

ticker: LEAT


text: The Company's general risk management program is designed to manage identified material risks, which would include material cybersecurity risks. We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities. We rely on a multidisciplinary team (including from our information security function, management, and third-party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; cyber insurance.


text: We work with third parties from time to time to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing. To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, IT asset management, cloud-based infrastructure, data center facilities, content delivery, encryption and authentication technology, corporate productivity services, and other functions.


text: We have certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting annual re-assessments during their engagement.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, due to evolving cybersecurity threats, we may not be able to protect all information systems. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information. Governance.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including a dedicated information technology manager, who reports to the CEO. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Board of Directors for certain cybersecurity incidents.


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct the company's response to cybersecurity incidents. The Board of Directors is responsible for overseeing the company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: We operate in an industry subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or partners; violation of privacy laws and other litigation and legal risk; and reputational risk. We have initiated a risk-based approach designed to identify and assess the cybersecurity threats that could affect our business and information systems. Our strategy is to maintain a high level of risk awareness, identify critical IT assets, regularly update or replace those assets, and systematically perform vulnerability testing, and to promptly remediate deficiencies. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and Cybersecurity and Infrastructure Security Agency ("CISA") best practices.

companyName: IntelGenx Technologies Corp.


text: We are adopting various tools and methodologies to manage cybersecurity risk that will be tested on a regular cadence. We are also in the process of monitoring and evaluating our cybersecurity posture and performance on an ongoing basis through scheduled vulnerability scans, penetration tests and threat intelligence feeds. We may require third-party service providers and consultants with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network. No risks from cybersecurity threats or previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition or results of operations. However, there can be no assurance that the controls and procedures in place to monitor and mitigate the risks of cyber threats will be successful or sufficient to avoid material losses or consequences in the future. The Company is currently in the process of implementing a more formalized cybersecurity program.


text: Our cybersecurity risk management and processes are led by our Vice President, Finance and Administration, with support of management, internal personnel and third-party providers. While management is responsible for the day-to-day management of cybersecurity risks, our Board of Directors, through its Audit Committee, has oversight of the Company's processes, policies and procedures for assessing, identifying, and managing material risks from cybersecurity threats including the integration and establishment of cybersecurity processes into the Company's overall risk management system or processes. On a quarterly basis, our VP Finance and Administration, presents necessary updates on our cybersecurity and other information technology risks that may affect us.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Dakota Gold Corp.

ticker: DC


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks, with assistance from third-party service providers. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: During the year ended December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: ZeroStack Corp.

ticker: ZSTK


text: We have implemented numerous policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless and personal devices for both Company business and personal matters while utilizing Company resources, among other relevant topics. These policies go through an internal review process on a periodic basis and are, if needed, updated and re-approved by the appropriate members of management.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information, or intellectual property. Risk from cybersecurity threats, including relating to past incidents, have not materially affected our systems or business. Any significant disruption to our operations or access to our systems could adversely affect our business and results of operations. Further, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: We established an interdisciplinary team to monitor and assess cybersecurity risks on an ongoing basis, which is led by our Chief Financial Officer ("CFO"). It is a cross-departmental team that consists of finance and operations personnel, as well as third party legal and information technology ("IT") consultants, with all significant implementation efforts executed by our IT consultant, who has extensive experience in IT, enterprise security and cyber risk management. This team is in charge of developing, maintaining and measuring compliance with the cyber risk management program, and dedicates significant resources to cybersecurity and risk management processes to adapt to the ever-changing cybersecurity landscape and to respond to emerging threats in a timely and effective manner.


text: When a potential incident is first detected, the matter is communicated to the CFO as soon as possible so that the Company may work quickly and diligently to re-secure its systems and work to minimize any damage and further risk to it as a result thereof. Upon receipt, the CFO is charged with immediately investigating the report to ensure the existence or possibility of a cyberattack and employs every effort toward thwarting or limiting a cyberattack, if ongoing, to the fullest extent possible to avoid further damage and exposure to the Company and its systems. As soon as an immediate threat or cyberattack is sufficiently contained to permit it, the CFO notifies the Chief Executive Officer of the situation, who is charged to direct the CFO on any additional or special measures to be taken, including but not limited to a Company-wide alert or directive, which the CFO must follow/implement without delay. Questions or concerns relating to a directive's validity may be confirmed only by the CFO, or a designated executive officer, through a known form of contact not questionably in breach. As soon as reasonably practicable after response efforts commence, the designated executive officers are required to notify the Chair of the Audit Committee of the situation and to thereafter keep the Chair apprised of all material developments, who may escalate the matter to the full Board in the Chair's discretion. Our emergency response plan also sets forth our procedures for a transition back into normal work practices, as well as security incident investigation, remediation procedures, security incident recovery and mandatory reporting.


text: Our Board of Directors oversees the Company's aggregate risk profile and risk management process. The Board of Directors administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.


text: Failures in, material damage to, or interruptions in our information technology systems, including as a result of cyber-attacks, and difficulties in updating our existing software or developing or implementing new software, could have a material adverse effect on our business or results of operations. We depend increasingly on our information technology systems in the conduct of our business. For example, we own, license or otherwise contract for technology and systems to do business with customers, including for order entry and fulfillment, processing and payment, product shipping and product returns. We also maintain internal and external communications, product inventory, supply, production and enterprise management, and personnel information on information systems. Our information systems are subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, security breaches and natural and man-made disasters. In particular, from time to time we and third parties who provide services for us experience cyber-attacks, attempted breaches of our or their information technology systems and networks or similar events, which could result in a loss of sensitive business or customer information, systems interruption or the disruption of our operations. The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and may be difficult to detect for long periods of time, and accordingly we may be unable to anticipate and prevent all data security incidents. Like many businesses, our systems come under frequent attack from third parties. We are required to expend capital and other resources to protect against such cyber-attacks and potential security breaches or to alleviate problems caused by such potential breaches or attacks. Despite the constant monitoring of our technology systems and hiring of specialized third parties to identify and address any vulnerabilities through implementation of network security measures, it is possible that computer programmers and hackers, or even internal users, may be able to penetrate, create systems disruptions or cause shutdowns of our network security or that of third-party companies with which we have contracted. As a result, we could experience significant disruptions of our operations and incur significant expenses addressing problems created by these breaches. Such unauthorized access could disrupt our business and could result in a loss of revenue or assets and any compromise of customer information could subject us to customer or government litigation and harm our reputation, which could adversely affect our business and growth.

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program utilizes the CIS Critical Security Controls framework, as a guide to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program includes the following key elements, among others: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: a team comprised of IT personnel responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents;


text: the periodic use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training; and a cybersecurity incident response plan to respond to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee receives reports from our Chief Information Officer. Our Chief Information Officer, who works closely with and supervises our IT team, has overall responsibility for assessing and managing any material risks from cybersecurity threats.


text: We have policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Rise Gold Corp.

ticker: RYES


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: As of July 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Enertopia Corp.

ticker: ENRT


text: We conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Executive Officer responsible with the responsibility of managing the cybersecurity risk assessment and mitigation process.


text: As part of our overall risk management program, we provide required training to consultants and employees in high risk areas on cybersecurity. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of our contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our technology development programs," "Our proprietary information, or that of our customers, suppliers and business partners, may be lost or we may suffer security breaches," and "Failure of our information technology systems could significantly disrupt the operation of our business.


text: To date, the Company has not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. The Company has not implemented any specific policies with respect to monitoring and managing cybersecurity threats. Moreover, the Company is aware of the evolution of cybersecurity risks and is taking proactive steps by keeping up to date our information systems and educating our personnel about these risks.

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of the data. The Company will be looking to adopt cybersecurity processes, technologies and controls to aid in its efforts to assess, prevent, identify and manage such risks.


text: Our cybersecurity program is strategically crafted to achieve the paramount goals of identifying, protecting, detecting, and responding to all potential risks and threats. Employing a defense-in-depth strategy, we proactively identify, investigate, and resolve vulnerabilities and security incidents in a timely manner.


text: Continuous improvement is integral to our cybersecurity approach. Regular assessments, conducted with the expertise of external security firms against international standards, allow us to quantify our program's effectiveness. The insights gained from these assessments serve as a foundation for continuous improvement efforts. Outcomes are reported to our Audit Committee for transparency and accountability. We rely on services from a variety of third-party providers to supply things such as cloud storage and networks. On an annual basis, we review these providers to assess their risk profiles. We rely on these third parties to have their own cybersecurity programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Despite facing directed attacks, our systems have withstood such challenges without material interruptions to our business operations. Recognizing the potential impact of significant disruptions, we remain steadfast in our commitment to fortify our systems against evolving threats. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. Refer to Item 1A "Risk Factors - Our business operations could be disrupted if our information technology systems fail to perform adequately or are breached."


text: Heading our cybersecurity program is our Chief Information Officer ("CIO"). Our CIO has over 30 years of experience in Software Engineering and Information Technology/Cybersecurity and is supported by skilled professionals from our Information Technology team. This seasoned team provides regular updates to our Enterprise Risk Management Steering Committee (the "ERM"), composed of our Chief Executive Officer, Chief Financial Officer, Chief Administrative Officer, and other members of our senior leadership. Our Audit Committee and Board of Directors receive regular reports from the ERM, as well as directly from our CIO on a quarterly basis. These reports cover various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. SUNOPTA INC.


text: Furthermore, our Board of Directors takes a proactive stance in overseeing our annual enterprise risk assessment. This comprehensive evaluation encompasses key risks, including those associated with security, technology, and cybersecurity threats, demonstrating our commitment to robust governance and risk management.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: One of the key functions of our Board of Directors (the "Board") is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. While we do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition, such threats could occur nonetheless.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks, with assistance from third-party service providers. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through training.


text: During the year ended December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: We have implemented numerous policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless and personal devices for both Company business and personal matters while utilizing Company resources, among other relevant topics. These policies go through an internal review process on a periodic basis and are, if needed, updated and re-approved by the appropriate members of management.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information, or intellectual property. Risk from cybersecurity threats, including relating to past incidents, have not materially affected our systems or business. Any significant disruption to our operations or access to our systems could adversely affect our business and results of operations. Further, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations.


text: We established an interdisciplinary team to monitor and assess cybersecurity risks on an ongoing basis, which is led by our Chief Financial Officer ("CFO"). It is a cross-departmental team that consists of finance and operations personnel, as well as third party legal and information technology ("IT") consultants, with all significant implementation efforts executed by our IT consultant, who has extensive experience in IT, enterprise security and cyber risk management. This team oversees developing, maintaining and measuring compliance with the cyber risk management program, and dedicates significant resources to cybersecurity and risk management processes to adapt to the ever-changing cybersecurity landscape and to respond to emerging threats in a timely and effective manner.


text: When a potential incident is first detected, the matter is communicated to the CFO as soon as possible so that the Company may work quickly and diligently to re-secure its systems and work to minimize any damage and further risk to it as a result thereof. Upon receipt, the CFO is charged with immediately investigating the report to ensure the existence or possibility of a cyberattack and employs every effort toward thwarting or limiting a cyberattack, if ongoing, to the fullest extent possible to avoid further damage and exposure to the Company and its systems. As soon as an immediate threat or cyberattack is sufficiently contained to permit it, the CFO notifies the Chief Executive Officer of the situation, who is charged to direct the CFO on any additional or special measures to be taken, including but not limited to a Company-wide alert or directive, which the CFO must follow/implement without delay. Questions or concerns relating to a directive's validity may be confirmed only by the CFO, or a designated executive officer, through a known form of contact not questionably in breach. As soon as reasonably practicable after response efforts commence, the designated executive officers are required to notify the Chair of the Audit Committee of the situation and to thereafter keep the Chair apprised of all material developments, who may escalate the matter to the full Board in the Chair's discretion. Our emergency response plan also sets forth our procedures for a transition back into normal work practices, as well as security incident investigation, remediation procedures, security incident recovery and mandatory reporting.


text: Our Board of Directors oversees the Company's aggregate risk profile and risk management process. The Board of Directors administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.


text: We rely on information technology and data to operate our business and develop, market, and deliver our products to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, software, and our critical data includes confidential, personal, proprietary, and sensitive data, collectively our "Information Assets". Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.