text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the headings "We may be the victim of business disruptions and security breaches, including cyber-attacks, which could lead to liability or could damage our reputation and financial results" and "We may be subject to information technology failures that could damage our reputation, business operations and financial condition" included as part of our risk factors disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: In the last three fiscal years, we have not identified any cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.

companyName: SILICON LABORATORIES INC.

ticker: SLAB

secItem: Item 1C


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee regularly reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports to the full Board of Directors based on these reviews. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the Chief Security Officer ("CSO") on a quarterly basis. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.


text: We have an Information Security Steering Committee (the "ISSC"), comprised of members of our executive team, our Chief Information Officer, CSO, and Chief Legal Officer. Our CSO, in coordination with the ISSC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our SecOps team communicates with and reports to the CSO, enabling the CSO and the ISSC to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CSO has over 25 years of security experience in multiple technology disciplines, including prior work experience leading cybersecurity teams, technology strategies and security architecture. He also holds several relevant degrees and certifications, including as a Certified Information Systems Security Professional ("CISSP") and a Certified Secure Software Lifecycle Professional ("CSSLP"), and holds Honors BSc degrees in Computer Science and Physics.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program, which we have continued to invest in developing. Our corporate cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party vendors and service providers, and facilitating coordination across different business units of the Company. Our corporate cybersecurity risk management program is based on and audited against industry standards, including ISO 27001 for Information Security Management Systems (ISMS) and the automotive industry's Trusted Information Security Assessment Exchange standard.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Our corporate cybersecurity team is responsible for operating our cybersecurity risk management program. The cybersecurity team determines with management an annual workplan for risk assessments, reviews, audits and tests. The cybersecurity team also conducts vulnerability assessments, security reviews and penetration tests on a regular basis in accordance with such workplan. Following risk assessments that require any remediation, the cybersecurity team then conducts a risk treatment and response process, including mitigation, remediation and risk reduction efforts. Our policies also require that Internet-accessible enterprise systems and applications must undergo a penetration test at least annually, and we engage specialized, independent third parties to conduct penetration tests and specific in-depth reviews of certain enterprise systems and applications.


text: With respect to overseeing and identifying cybersecurity risks associated with third parties, we seek to impose certain cybersecurity requirements on critical third parties with whom we do business. The cybersecurity team performs risk assessments, due diligence checks and validation of key security controls in accordance with our cybersecurity policies and standards for third-party vendors and service providers with whom we exchange information or integrate our information systems and networks. We include cybersecurity and privacy addenda and clauses in our agreements with such third parties where applicable and seek to pass through any necessary regulatory and contractual requirements to such third parties. When we do become aware that a third-party vendor or service provider has experienced a compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate or by exercising any applicable contractual remedies we may have, such as a right to indemnification.


text: On a semi-annual basis the cybersecurity team conducts a program performance evaluation with management to assess the continuing suitability, adequacy and effectiveness of the Company's cybersecurity risk management program, including with respect to the fulfillment of cybersecurity objectives and compliance with industry standards, and to recommend changes to the Company's threat modeling, priorities for future risk assessments, policy adjustments in response to newly identified risks or non-compliance, and overall risk acceptance.


text: To foster a culture of cybersecurity awareness within the Company and provide employees with further knowledge of cybersecurity-conscious behavior, all employees of the Company are required to attend cybersecurity training sessions during the onboarding process and at least once per year.


text: Our organizational cybersecurity program is under the direction of our Chief Information Security Officer ("CISO") who receives reports from our cybersecurity team and oversees the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. Our CISO reports to our Chief Operating Officer ("COO"), who may discuss cybersecurity risks and other operational risks with other senior management as appropriate. Our CISO and dedicated cybersecurity team personnel are certified and experienced information systems security professionals and cybersecurity managers with many years of experience. Our CISO has served in that position since 2019 and has over 25 years of managerial and professional cybersecurity expertise. He has held the role of CISO and other senior management positions with NDS Services, Cisco Systems, Inc. and Deloitte and has also served as cybersecurity consultant for companies in multiple global industries. Our COO has extensive experience in project management and cybersecurity, including from past roles with Verint Systems Inc. and Cisco Systems, Inc. as well as the establishment and management of the Company's cybersecurity team prior to our CISO joining the Company.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. The Company's cybersecurity team regularly meets with the COO to report its findings. The COO in turn periodically reports on such matters to the Chief Executive Officer and other members of management.


text: As part of our continued investment in developing our overall enterprise risk management program, the COO and other members of management make updates to the full board of directors, and going forward beginning in 2024, will also provide updates to the audit committee of our board of directors (the "Audit Committee"), on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies. In addition to such updates, and as part of our incident response processes, our COO is also responsible for informing the Audit Committee of material cybersecurity threats and incidents, based on management's assessment of risk.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks and mitigate and remediate cybersecurity threats and incidents. Both management and the Audit Committee also report material cybersecurity risks to our full board of directors, based on management's assessment of risk.


text: In 2023, we did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Privacy, Data, and Cybersecurity" in this annual report on Form 10-K.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We design and assess our program generally based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Although our program may not meet the technical requirements of the NIST CSF, we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Additionally, as we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards (PCI DSS) in relation to our program.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment, including, by regularly scanning our environment for vulnerabilities, performing penetration testing and engaging third parties to assess the effectiveness of our technical cybersecurity practices.


text: a multi-disciplinary security team overseen by our Information Security Council, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis;


text: the use of a third-party Managed Security Service Provider (MSSP) that includes a 24x7 security operations center (SOC) that is designed to monitor and analyze suspected suspicious activity on our internal network and remediate or escalate activity as appropriate; regular cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;


text: use of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Detection and Intrusion Prevention (IDS/IPS) that scans data in transit to help detect and prevent the execution of harmful code; and a third-party risk management process for service providers, suppliers, and vendors who have access to our information systems.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or are effective in protecting our systems and information. We are not currently aware of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of steps the Company has taken to monitor or mitigate significant cybersecurity risks. The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff and/or external experts, as appropriate, as part of the Board of Directors' continuing education.


text: Our management formed an interdepartmental Information Security Council (ISC), comprised of senior executives from multiple disciplines, including our CIO and Vice President of Infrastructure Services, to assess and manage our material risks from cybersecurity threats. The ISC has primary responsibility for our overall cybersecurity risk management program. Our CIO, Vice President of Infrastructure Services, and others within our Information Technology department supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and Vice President of Infrastructure Services have a combined 50+ years of experience in information technology, with increasing oversight of cybersecurity responsibilities over the past 20+ years.


text: Our management teams, including the ISC, our CIO, Vice President of Infrastructure Services, and others within our Information Technology department, as appropriate, supervise efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, consumers, employees and other stakeholders and oversees all cybersecurity matters. Management plays a central role in our information security program, which is a critical component of our enterprise risk management and includes the implementation of controls aligned with industry best practices and applicable frameworks to identify threats, deter attacks and protect our Company assets. In addition, we engage a range of cybersecurity experts, including cybersecurity auditors, assessors, and consultants, in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights and ensure that our cybersecurity strategies and processes remain in line with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Monster Beverage Corp

ticker: MNST


text: Our Chief Information Officer and his team are responsible for leading our cybersecurity strategy, policy, standards, architecture, and processes. Our information security leadership team has more than 20 years of combined experience in cyber and information security matters. Our information security program is also supported by our Chief Compliance Officer and other members of senior management. We conduct periodic reviews of our program by internal and external experts with the results of those reviews reported to senior management and the Board. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners. For example, we require certain third-party service providers and other business partners to provide us with SOC II reports that demonstrate compliance with security standards. We also actively engage with industry participants, as well as intelligence and law enforcement communities as appropriate, as part of our continuing efforts to evolve our cybersecurity governance.


text: Our information security team promptly informs our Incident Response Team of potentially material cybersecurity incidents, including with respect to our third-party service providers. The Chief Information Officer briefs our Co-Chief Executive Officers and reports to the Audit Committee of our Board (the "Audit Committee"). The Audit Committee, in turn and if necessary, briefs the Board on, among other matters, our cyber risks and threats, the status of projects to strengthen our information security systems (such as employee cybersecurity training), an assessment of the information security program, and the emerging threat landscape. The Cybersecurity and Compliance Steering Committee, comprised of senior members of management, has convened and is scheduled to convene on a quarterly basis to review all matters related to strengthening our cybersecurity posture and providing governance.


text: For a discussion regarding risks from cybersecurity threats that are reasonably likely to affect the Company, see "Part I, Item 1A – Risk Factors – Our use of information technology and third party service providers exposes us to cybersecurity breaches and other interruptions that could disrupt our business operations and adversely impact our reputation and results of operations" and "If we fail to comply with data privacy and personal data protection laws, we could be subject to adverse publicity, government enforcement actions and/or private litigation, which may negatively impact our business and operating results."


text: We depend on technology systems, some of which are operated and managed by third parties, to operate our business. Our business is limited to searching for and implementing an initial business combination. As such, we process a limited number of invoices and rely primarily upon third parties for cybersecurity compliance. Only four individuals are involved in our day-to-day operations and those operations are minimal.

companyName: ExcelFin Acquisition Corp.


text: In October 2023, we made payments on three separate invoices which payments were later determined by management to have been made in error. Two of the payments were later recovered from the vendors, but it is unlikely that the third payment will be recovered. Our management has conducted a thorough investigation related to these events and has concluded there was a material weakness in our internal control over financial reporting related to our review and approval of cash disbursements.


text: To address this material weakness management has devoted, and plans to continue to devote, significant effort and resources to the remediation and improvement of our system for verification of which invoices to pay. We implemented additional controls related to vendor verification and will introduce mandatory cybersecurity training. We implemented a list of specific points to validate before payments are released, requiring evidence of validation by approvers.


text: Our cybersecurity risk management program includes the monitoring of our systems and networks for vulnerabilities, threats and, intrusions; coordination of our response to cybersecurity incidents; the training for our management and employees on new and developing risks and threats. Finally, our cybersecurity risk management program includes procedures to facilitate that information regarding cybersecurity incidents are shared with the Board to enable assessments related to disclosure and notice requirements to be timely and correctly made.


text: Although no cybersecurity incident during the year ended December 31, 2023 resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations, the scope of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information.


text: Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Board of Directors is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and exposures.


text: Our Chief Executive Officer, Joe Ragan, leads management's assessment, identification and management of cybersecurity risk. Mr. Ragan is familiar with cybersecurity matters arising out his public company chief financial officer experience. Our Board of Directors oversees our enterprise risk management system. The Board of Directors meets quarterly, or more frequently as necessary, with members of management to provide updates on all matters, including cybersecurity.


text: We have established an Information Security department within our Risk Management department that is independent of the Information Technology department. Furthermore, we have a documented Information Security Strategy that guides the Information Security teams and business departments across the Company. The Information Security Strategy incorporates the external landscape, risk assessments, Company's strategy, information technology strategy and other inputs.

companyName: Sterling Bancorp, Inc.


text: Our appetite for cybersecurity risk is established within our enterprise risk appetite. We undertake an information technology risk assessment annually. This assessment considers our information assets, the potential threats/risks to those assets and the effectiveness of existing controls to identify and assess inherent and residual levels of information security risks. This assessment also identifies any control gaps that may exist and informs appropriate mitigation strategies to conform to our appetite for cybersecurity risk. Remediation plans for any identified gaps are monitored by management quarterly. Results from this risk assessment may affect changes in the Information Security Strategy and information security budget. Annually, we engage a third-party audit firm specializing in information technology audits to review the risk assessment and our Information Security Program overall as part of our information technology general controls audit.


text: We have previously experienced cybersecurity incidents, from time to time. These incidents have not materially affected our business strategy, results of operations or financial condition. We are not currently aware of any cybersecurity incidents that would have a material effect on our business strategy, results of operations or financial condition.


text: We use a security framework to guide our overall security posture, which has helped us develop and enhance our Information Security Policy, Incident Response Policy and Business Continuity Policy. These policies guide us in our effort to manage and control information technology risk and to define and communicate information security responsibilities and accountability throughout the Company. These policies also set the requirements to help ensure that we safeguard our data and information systems to reduce risk and minimize the effect of potential incidents. These policies are supported by written standards and procedures that ensure conformity with the policies that the board of directors has set forth. Pursuant to our Incident Response Policy, we have adopted a written Incident Response Plan that documents employee and management responsibilities, incident classifications and the procedures to be followed during a cybersecurity incident. The Incident Response Plan is tested annually through a tabletop exercise led by a third-party vendor who assists in developing and executing the exercise.


text: We have a documented Third-Party Risk Management Policy and Program to ensure that our vendor relationships are assessed, monitored and documented appropriately. It is our policy to exercise appropriate oversight and risk management of the activities conducted through significant third-party relationships, taking into consideration the nature, magnitude, complexity and risk potential of the arrangement. Vendors are monitored for cybersecurity issues during the initial onboarding processes and on an ongoing basis. We may review or require a SOC 2 Type 2 report, cybersecurity controls, cyber insurance and monitoring frequency depending on our assessment of the risk of any vendor.


text: Management performs ongoing monitoring of the Information Security Program with a range of reports and tools that are commensurate with our risk profile. These reports and tools ensure the program continues to comply with all policies related to information technology risk and information security.


text: We have engaged a third-party provider that manages and monitors our Security Operations Center, including our firewall and intrusion detection and prevention system. Additionally, management has engaged a separate vendor to monitor and manage endpoint detection and response applications on all Company devices, including workstations, laptops and servers.


text: Additional controls include vulnerability scanning, identity and access management, mobile device management and other various security controls. We also conduct periodic phishing tests and social awareness training for all employees, which include how to report and escalate suspected incidents.


text: Information security metrics are reported quarterly to the Information Technology Steering Committee, the Enterprise Risk Management Committee and the Board Risk Committee to provide evidence of the effectiveness of these controls and tools. Any identified specific gaps in the controls are sent to management quarterly until resolved.


text: Cybersecurity risks and activities are reported quarterly to the Information Technology Steering Committee and the Enterprise Risk Management Committee. The Bank's chief risk officer and interim chief information officer are part of the Information Technology Steering and Enterprise Risk Management Committees. The Bank's chief risk officer has over 15 years of experience managing the supervision of Information Security risks for financial institutions. The Bank's interim chief information officer has over 30 years of experience managing technology.


text: We have also employed a chief information security officer who reports to the chief risk officer. The chief information security officer is responsible for information security, information technology risk management, vendor management and business continuity programs. The chief information security officer holds a graduate degree in cybersecurity and numerous information security certifications, including certified information systems security professional, certified information security manager, certified cloud security professional and qualified technology expert. Additionally, the chief information security officer has worked in the information security field for over 20 years within several financial institutions, implementing cybersecurity strategies, programs, policies and procedures.


text: Our Board Risk Committee generally meets quarterly and is responsible for overseeing cybersecurity risk and our information security program, including cybersecurity, and ensuring the continued development of the program as the Company grows and cyber and information risk exposures change. At each Board Risk Committee meeting, the chief information security officer presents information security metrics and any updates to the Information Security Program. New and changing cybersecurity risks are discussed when needed. The chair of the Board Risk Committee also serves as a board member and previously served as the chair and interim chief executive officer of the Information Systems Audit and Control Association. As a board member of the Information Systems Audit and Control Association, she is a member of their Audit and Risk Committee, Compensation and Human Capital Committee and Governance and Nominating Committee. All cybersecurity-related policies are reviewed and approved annually by the chief information security officer, chief risk officer, Enterprise Risk Management Committee, Board Risk Committee and the board of directors.


text: The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2023 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: VOC Energy Trust

ticker: VOC


text: Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity strategy and procedures are embedded in its Three Lines of Defense model.


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cyber threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. BNY Mellon also has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.


text: BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third-party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.


text: ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk & Compliance group, is responsible for and manages BNY Mellon's risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.


text: BNY Mellon's Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.


text: Oversight and Governance BNY Mellon's management is responsible for assessing and managing BNY Mellon's material risks from cybersecurity threats with oversight provided by its Board of Directors (the "Board") and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon's risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon's cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.


text: At the management level, BNY Mellon's Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon's significant technology projects and initiatives, reviews reports from management concerning ISD and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board. The Technology Oversight Committee is chaired by the Chief Information Officer (the "CIO") and its members include the CISO.


text: BNY Mellon's Technology Risk Committee is responsible for, among other things, overseeing and reviewing significant cybersecurity incidents. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is co-chaired by the Head of Technology Risk and Control and the Chief Technology Risk Officer, and the CISO is a member.


text: BNY Mellon's CIO, CISO and Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon's CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon's CIO has served in that position since 2017 and previously held roles as Chief Information Officer, Chief Technology Officer, and numerous other technology management positions at other large financial institutions. BNY Mellon's Chief Technology Risk Officer joined BNY Mellon in 2021 and previously served as Global Head of Technology Risk Management, Chief Information Security Officer, Global Head of Cyber Risk and Operational Resilience and Chief Risk Officer for Technology and Operations at other large financial institutions.


companyName: MV Oil Trust

ticker: MVO


companyName: ECA Marcellus Trust I

ticker: ECTM


text: Cybersecurity is an important aspect of our business operations, and we are committed to protecting our systems, data, and the information of our clients and stakeholders. We recognize that cybersecurity threats are constantly evolving and that maintaining robust security measures is an ongoing process. Below is an overview of our cybersecurity risk management and the measures we have in place:

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: Our Board of Directors and senior management are actively involved in overseeing our cybersecurity policies and practices and managing those responsible for coordinating and implementing cybersecurity initiatives across the organization.


text: Risk Assessment and Management: We conduct risk assessments to identify potential cybersecurity threats and vulnerabilities. This includes evaluating the likelihood and potential impact of various threats, such as data breaches, malware attacks, and insider threats. Based on these risk assessments, we develop and implement risk management strategies to mitigate identified risks.


text: Information Security Policies and Procedures: We have established information security policies and procedures that govern the use, protection, and handling of sensitive information. These policies cover areas such as data encryption, access controls, password management, incident response, and employee training.


text: We employ a range of technical measures to secure our network and infrastructure, including firewalls, intrusion detection and prevention systems, and vulnerability assessments. We also use encryption to protect data both in transit and at rest.


text: Employee Training and Awareness: We provide cybersecurity training to employees to raise awareness of the latest threats and best practices for protecting sensitive information. This includes training on how to recognize phishing attempts, handling secure data, and reporting security incidents.


text: We assess the cybersecurity practices of our third-party vendors and service providers, including conducting due diligence on vendors before engaging their services and monitoring their compliance with our security requirements.


text: We comply with all applicable laws and regulations related to cybersecurity, including data protection and privacy laws.


text: While we believe that our current cybersecurity measures are robust, we recognize that the cybersecurity landscape is constantly evolving, and we remain vigilant in monitoring and adapting our practices to address emerging threats. We are committed to maintaining the confidentiality, integrity, and availability of our systems and data and to protecting the interests of our clients and stakeholders.


text: We recognize the critical importance of maintaining the trust and confidence of investors, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO). In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process.


text: To mitigate these risks, we have implemented technology solutions that are designed to recognize anomalous activity and behavior on systems used by TMC employees, alongside other technical safeguards including: Web Application Firewalls (WAF) Endpoint protection and response Security Event and Incident Management (SIEM) Identity and Access management (IAM)


text: Multi-factor authentication We utilize a third-party consultancy to provide services including security audits, CISO, risk management and response strategies. This consultancy provides the Chief Technology Officer, who is responsible for leading our cyber security strategy, guidance on policy, standards and processes alongside managing the risk management process.


text: We identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, and the ISO specifically basing our policies and procedures on ISO 27001 guidelines.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; dark web scanning to determine any leaked credentials both corporate and personal for key employees.


text: leverage the NIST incident handling framework and our MSPs to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident;


text: carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are dependent upon information technology systems, which are subject to cyber threats, disruption, damage and failure" which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats, as part of our Enterprise Risk Management system. In the event of a cybersecurity incident that meets established reporting thresholds, our audit committee will receive prompt and timely information regarding such incident, as well as ongoing updates until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer with guidance from external security consultant. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant degrees and certifications, including Certified Information Security Manager and Certified CISO. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: We believe cybersecurity is critical to advancing our business securely. We face a multitude of cybersecurity threats, have experienced, and will continue to experience, cyber incidents in the normal course of business. Such cybersecurity threats could have a material adverse effect on our business, financial condition, operations, results of operations, performance, cash flows or reputation. Our service providers (including the transfer agent), and other business contacts may face similar cybersecurity threats, and a cybersecurity incident impacting these persons or entities could materially adversely affect our operations, performance and results of operations.

companyName: TLGY ACQUISITION CORP

ticker: TLGYF


text: These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity. The Board and/or our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, the management will report to the Board and/or Audit Committee on incidents of material cybersecurity risks facing us and any third parties and the measures that may be taken to mitigate such risks. In addition to such reports and updates, the management will provide updates to our Board and/or our Audit Committee as to changes to our cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.


text: While prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.


text: Information systems and other technologies, including those related to the Corporation's information and operational technology systems, and its technical and environmental data, are an important part of the Corporation's business activities. We must comply with certain elevated contractual requirements, including those related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the United States Department of Defense ("DOD"). We continue to implement cybersecurity processes designed to align with DOD requirements, instructions and guidance and work with the DOD as needed to assess cybersecurity risk and on policies and practices aimed at mitigating these risks. Accordingly, the Company maintains processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: Such processes include the use of traffic monitoring tools, as well as training users to detect, report, and prevent unusual behavior. We also employ monitoring mechanisms to help us detect and respond to cybersecurity threats. We conduct regular assessments and testing of the effectiveness of these controls, including security audits, incident response planning, and regulatory compliance assessments. We seek to foster cybersecurity awareness and responsibility throughout the organization by regularly providing our employees with training on cybersecurity practices.


text: We use user access controls to limit unauthorized access to sensitive information and critical systems. In addition, we use multi-factor authentication for remote access, use of privileged accounts and access to critical systems. Encryption methods are used to protect sensitive data. This includes the encryption of customer data, financial information, and other confidential data. The implementation and management of these cybersecurity processes are integrated with the Company's overall operational risk management processes, which seeks to limit our exposure to unnecessary risks across our operations.


text: We maintain an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Pursuant to the incident response plan, the identifying party is required to notify the Company's CFO and Board of Directors of certain cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The incident response plan also includes procedures for: Gathering information about the cybersecurity incident. Consulting with cybersecurity consultants and other parties to assess the cybersecurity incident.


text: Evaluating the materiality of the cybersecurity incident, determining whether there are disclosure obligations under applicable securities laws, and external reporting, as required.


text: We engage third party service providers including consultants and auditors in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks.


text: Impacts from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have been subject to certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. For additional information about the risks to our business associated with a breach or compromise to our information technology systems, see section Item 1A, Risk Factors – System security vulnerabilities, data breaches, and cyber-attacks could compromise proprietary or otherwise sensitive information or disrupt operations, which could adversely affect Perpetua Resources' business, reputation, operations, and stock price.


text: Our IT Systems Administrator is responsible for assessing and managing our risks from cybersecurity threats and oversees our cybersecurity program. The IT Systems Administrator reports directly to our Chief Financial Officer (CFO). Our IT Systems Administrator holds an associate degree in computer application and support and has served in various roles in information systems administration for over eight years, including roles involving managing information technology and systems and implementing cybersecurity programs.


text: Our full Board and our Audit Committee oversee risks from cybersecurity threats and our cybersecurity practices and policies. Accordingly, our CFO periodically updates the Board and Audit Committee on cybersecurity matters, including cybersecurity risks. Additionally, our Board and Audit Committee, as well as senior management, receive reports on an as-needed basis regarding our cybersecurity posture, cybersecurity incidents, and remediation efforts.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K.

companyName: Nabors Energy Transition Corp. II


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and, as noted in Item 1A. Risk Factors of this Annual Report on Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for the Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations and financial condition.

companyName: Pegasus Digital Mobility Acquisition Corp.


text: As a blank check company, we have no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Due to our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Report. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Spring Valley Acquisition Corp. II

ticker: SVIIF


text: The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2023 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: MESA ROYALTY TRUST/TX

ticker: MTR


text: Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity strategy and procedures are embedded in its Three Lines of Defense model.


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cyber threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. BNY Mellon also has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.


text: BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third-party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.


text: ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk & Compliance group, is responsible for and manages BNY Mellon's risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.


text: BNY Mellon's Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.


text: Oversight and Governance BNY Mellon's management is responsible for assessing and managing BNY Mellon's material risks from cybersecurity threats with oversight provided by its Board of Directors (the "Board") and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon's risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon's cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.


text: At the management level, BNY Mellon's Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon's significant technology projects and initiatives, reviews reports from management concerning ISD and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board. The Technology Oversight Committee is chaired by the Chief Information Officer (the "CIO") and its members include the CISO.


text: BNY Mellon's Technology Risk Committee is responsible for, among other things, overseeing and reviewing significant cybersecurity incidents. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is co-chaired by the Head of Technology Risk and Control and the Chief Technology Risk Officer, and the CISO is a member.


text: BNY Mellon's CIO, CISO and Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon's CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon's CIO has served in that position since 2017 and previously held roles as Chief Information Officer, Chief Technology Officer, and numerous other technology management positions at other large financial institutions. BNY Mellon's Chief Technology Risk Officer joined BNY Mellon in 2021 and previously served as Global Head of Technology Risk Management, Chief Information Security Officer, Global Head of Cyber Risk and Operational Resilience and Chief Risk Officer for Technology and Operations at other large financial institutions.


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying, evaluating suitable acquisition transaction candidates and completing the merger with our target acquisition companies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: VSEE HEALTH, INC.

ticker: VSEE


text: Our comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats involves a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas. The cybersecurity risk management program includes: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment;


text: A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training;


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and, A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees the implementation of the cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from the Company's Information Systems Manager. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. The Company's Information Systems Manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.


text: We are a blank check company whose business purpose is to effect a merger, capital stock exchange, asset acquisition, stock purchase, reorganization or similar business combination with one or more businesses or assets. We have no significant operations. Therefore, while management monitors our exposure to cybersecurity risk, we have not adopted specific processes for assessing and managing such risk. The audit committee is generally responsible to discuss with management any significant risks or exposures, and as necessary report such risks or exposures to our board of directors. We have not encountered any cybersecurity incidents since our initial public offering. However, sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure could lead to corruption or misappropriation of proprietary information and sensitive or confidential data. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. See Item 1A. Risk Factors, "Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss" of this Annual Report for a discussion of cybersecurity-related risks.

companyName: CONX Corp.


text: Cybersecurity and information privacy are important parts of our overall approach to risk management. We have documented cybersecurity policies and procedures to identify, assess and manage risks from cybersecurity threats. We believe our cybersecurity policies and procedures are reasonably designed to materially protect the security of both our data and the data in our custody. To protect our information systems, we employ various security tools supporting protection, detection and response capabilities, including anti-malware and security applications, and periodic risk analyses. We maintain a cybersecurity incident response plan to help ensure a timely, consistent response to actual or attempted cybersecurity incidents impacting the Company.

companyName: Greenbrook TMS Inc.


text: We may engage third parties from time to time, including consultants and auditors to conduct assessments of information systems. We have policies and processes in place to govern third-party access and the risks associated with such access.


text: Our systems face cybersecurity risks, and we have in the past experienced threats to and breaches of our data and systems. However, to date, these incidents have not had a material impact on our business, results of operations or financial conditions. There can be no assurance that we will not experience any material cybersecurity threats or incidents in the future. See Item 1A "Risk Factors—A material disruption in or security breach affecting our information technology systems could significantly affect our business and lead to reduced sales, growth prospects and reputational damage".


text: Cybersecurity at our Company is led by our Chief Information Security Officer (" CISO ") and our Compliance and Privacy Officer and overseen by our Board. One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our CISO and our Compliance and Privacy Officer provide periodic reports to the Board regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing and activities of third parties. The current CISO has over twenty years of experience in information technology and security, and his background includes technical experience, strategy and architecture focused roles, cyber and threat experience, and various leadership roles.


companyName: Mountain & Co. I Acquisition Corp.


text: Cybersecurity Risk Management and Strategy We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: We intend to implement a formal cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to address potential cyber incidents swiftly and effectively.


text: In designing and evaluating our cybersecurity program, we intend to adopt the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 will be for guidance purposes to frame our risk identification, assessment and management processes and will not equate to compliance with any specific technical standards or requirements.


text: The key components of our future cybersecurity program are expected to include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;


text: a third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents;


text: engagement with external service providers to evaluate, enhance, or support our security measures; and an incident response plan outlining specific procedures for managing cybersecurity incidents;


text: The governance of cybersecurity risks is a critical function of our Board which has a key role in the oversight of cybersecurity and related technology risks. The Board is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.


text: The Board will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cyber incidents and ongoing risk management efforts.


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Chief Financial Officer and Chief Executive Officer. This team will be at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach will include regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.


text: Operations in Emerging Markets The Company has its material properties and operating subsidiaries in Botswana. It is possible that operating in Botswana may expose the Company to a certain degree of political, economic and other risks and uncertainties. In conducting its operations in Botswana, the Company has, among other things: (i) engaged and maintained experienced management and technical teams located in Botswana and/or with extensive experience in operating properties in Africa; (ii) certain members of the board and management routinely visit the Company's Botswana properties; (iii) retained advisors and technical experts in Botswana including its local counsel, Bookbinder Business Law (" Bookbinder "); and (iv) generally maintained robust internal control over its foreign subsidiaries, all of which are more particularly described below.


text: Subsidiaries and Operations in Botswana The Company's principal business activity in Botswana is the re-development of the Selebi Mines and the Selkirk Mine (together, the " Botswana Assets ").


text: The establishment and development of PNGPL and PNRPL, each of which is a Botswanan entity, adds an additional regulatory framework within which the Company operates and is supplementary to the regulatory framework existing in Canada. The Company holds its interest in the Selebi Assets and the Selkirk Assets indirectly through its 100% owned subsidiaries, PNRPL and PNGPL respectively.


text: The Company's operating entities in Botswana are governed in accordance with applicable local laws and entity-wide governance principles. The directors and management of the Company's operating entities in Botswana are generally comprised of a majority of senior management employees and where required by local laws, local residents, who are generally longstanding local management level employees, or local corporate counsel. In addition, certain members of the Company's management have experience conducting business in Botswana, as detailed below, where the Company has maintained operations since 2021. Operating in Botswana requires greater internal controls and adherence to a regulatory framework which creates challenges in relation to decision-making, communication, and compliance. The Company has experienced management and has retained legal advisors and consultants to help facilitate adherence to regulatory requirements in order to meet this challenge.


text: We face many cybersecurity threats including ransomware, denial-of-service attacks, business email compromise, and persistent threats from state-affiliated groups. We have experienced cyber-attacks in the past and may experience cybersecurity incidents in the future. While prior incidents have not materially affected our business, results of operations or financial condition, there is no guarantee that a future cyber threat or cyber incident would not affect our business strategy, results of operations or financial condition. See Item 1A. Risk Factors for more information on our cybersecurity risks.

companyName: AAR CORP

ticker: AIR


text: We maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. Our cybersecurity strategy and risk management processes use the National Institute of Standards and Technology governance requirements and cybersecurity framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our approach to cybersecurity risk management includes multiple complementary elements to mitigate our cybersecurity risks. We utilize multi-layered defenses to help prevent attacks including the use of data analytics to help detect anomalies and search for cyber threats. We have comprehensive cyber threat detection and response capabilities with applied threat intelligence, and continuous monitoring to complement other technology, processes and threat detection techniques we have in place. We subscribe to third-party managed security services that continuously monitor our systems and networks to assist with early cybersecurity threat detection and protection.


text: We work with government, customer, industry and/or supplier partners to gather and develop policies and standards and share information to address cyber threats. We conduct information security assessments of partners before sharing or allowing the hosting of data in computing environments managed by third parties. We require our employees to complete phishing and other awareness training to help identify, avoid and mitigate cybersecurity threats.


text: While our primary focus is on prevention and detection of cybersecurity threats, we have response and recovery plans in effect, as well as service agreements with outside experts should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The detailed plan defines the roles and responsibilities of all parties included in our cybersecurity incident response team which incorporates our IT team, senior management, and other functional areas.


text: We also have controls and procedures for reporting material cybersecurity incidents, including review of significant cybersecurity incidents by a cross-functional team to determine whether further escalation is necessary. We also periodically conduct practice exercises with management to familiarize the management team with our cyber incident response capabilities and processes. We also conduct internal and third-party assessments or penetration tests to validate our cybersecurity controls and improve our security posture. We also maintain cybersecurity liability insurance coverage.


text: To facilitate the prevention, detection and timely response to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for managing our information security strategy, policies, standards, and processes. The CISO reports directly to our Chief Digital & Technology Officer ("CDTO"), who reports directly to our Chairman, President and Chief Executive Officer. Our CDTO and CISO have extensive experience and expertise in developing, implementing, and operating security policies and procedures covering our network and critical data. The CDTO and CISO regularly review cybersecurity matters with members of our senior management. These discussions include the latest cybersecurity risks and threats, the status of our cybersecurity incident response plan, and our overall process relating to the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: Our Board of Directors, through its Audit Committee, is responsible for overseeing our cybersecurity risk management. On a regular basis, the Board of Directors or Audit Committee receive and review reports from the CDTO and CISO relating to the status of cybersecurity planning and protections, the overall state of our cybersecurity program, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks.


text: The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2024 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.


text: Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity risk management program is embedded in its three lines of defense model.


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cybersecurity threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. In addition, BNY Mellon maintains a preparedness program designed to reinforce cybersecurity risk management practices and compliance with BNY Mellon's policies and procedures. The preparedness program includes mandatory training for all employees, contractors and consultants, enhanced training for those in roles presenting higher risk, calibrated phishing email simulations, distribution of information security awareness materials and cybersecurity event simulation exercises. In addition, BNY Mellon leverages both internal and external assessments and engages with third-party assessors, consultants and auditors to evaluate and test its cybersecurity controls and provide guidance on potential improvements, including design and operating effectiveness. BNY Mellon has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.


text: BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third-party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.


text: ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk & Compliance group, is responsible for and manages BNY Mellon's risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.


text: BNY Mellon's Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.


text: Oversight and Governance BNY Mellon's management is responsible for assessing and managing BNY Mellon's material risks from cybersecurity threats with oversight provided by its Board of Directors (the "Board") and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon's risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon's cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.


text: At the management level, BNY Mellon's Technology Oversight Committee, which is the senior management committee responsible for the governance and oversight of BNY Mellon's significant technology projects and initiatives, reviews reports from management concerning ISD and is responsible for, among other things, escalating issues, including significant cybersecurity threats and incidents, to the Technology Committee of the Board. The Technology Oversight Committee is chaired by the Chief Information Officer (the "CIO") and its members include the CISO.


text: BNY Mellon's Technology Risk Committee is the most senior governance committee primarily focused on cybersecurity and technology risk issues and is a part of the second line of defense risk function. It is responsible for, among other things, overseeing and reviewing emerging cybersecurity risks, significant cybersecurity incidents and remediation plans. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is chaired by the interim Chief Technology Risk Officer. Members include key leaders from the first line of defense, including the CISO.


text: BNY Mellon's CIO, CISO and interim Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon's CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon's CIO joined BNY Mellon in September 2024 from a large multinational company, where she was responsible for overseeing information technology and cybersecurity operations. BNY Mellon's interim Chief Technology Risk Officer joined BNY Mellon in November 2024 and has previous experience as Global Head of Cyber, Technology and Information Security Risk Management at a global systemically important financial institution and over a decade of experience serving the U.S. intelligence community in a variety of cybersecurity-related positions.


companyName: VOC Energy Trust


companyName: MV Oil Trust


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks arising from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic assessments to identify such cybersecurity threats.

companyName: CHINA AUTOMOTIVE SYSTEMS INC/2


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. Our IT leadership reports to our Chief Executive Officer (CEO) periodically and on an as-needed basis to manage our risk assessment and mitigation process. We monitor and test our safeguards and regularly conduct training for our employees on these safeguards, in collaboration with human resources, IT, and management. We are committed to promoting a company-wide culture of cybersecurity risk management.


text: We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the financial year ended December 31, 2024.


text: We rely on the cybersecurity strategy and policies implemented by HMC Capital, the ultimate parent of our Sponsor. HMC Capital's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. HMC Capital's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. HMC Capital has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: StratCap Digital Infrastructure REIT, Inc.


text: HMC Capital's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or our Advisor. HMC Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us or our Advisor, is integrated into HMC Capital's risk management program. In addition, HMC Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.


text: HMC Capital's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness training, including for all of the employees of our Sponsor and its affiliates. Our Sponsor undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Sponsor's and our critical third-party vendors and other partners. Our Sponsor also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: Senior management and personnel of our Sponsor and our Advisor, which includes our Advisor's personnel, work to conceive, implement, and monitor the effectiveness of a program designed to protect our information systems from cybersecurity threats and to promptly respond to any security incidents.


text: In the event of a cybersecurity incident impacting us or our Advisor, our Sponsor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of our Sponsor, including coordinating with the relevant members of our Advisor. The incident response plan includes notification to the applicable members of cybersecurity leadership, and, as appropriate, escalation to the full HMC Capital risk management team and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee of our board of directors and to our full board of directors, if appropriate.


text: Oversight of Cybersecurity Risks Our board of directors and audit committee have primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Certain members of the HMC Capital cybersecurity team periodically report to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters. Such reporting includes updates on HMC Capital's cybersecurity program as it impacts us, the external threat environment, and HMC Capital's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and HMC Capital's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Material Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material cyber incident and the expenses we have incurred from information security incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors- Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results."