text: The program also includes training that reinforces our policies, standards, and practices, as well as the expectation that employees comply with these policies. The training engages personnel on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests. We maintain a cybersecurity risk insurance policy.


text: Governance; Board Oversight Our Audit Committee is responsible for reviewing our information security programs, including cybersecurity. IT provides regular updates to the Audit Committee on our IT security strategy, secure score assessments, penetration testing results, and status of risk mitigation activities, where applicable. IT also notifies the Audit Committee and Executive Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities, as appropriate.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX

secItem: Item 1C


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the Center for Internet Security (CIS) control objectives and benchmarks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS objectives and benchmarks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: cybersecurity awareness training and communications for employees;


text: a dedicated security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; cybersecurity controls to detect cybersecurity incidents or risks within our IT Systems;


text: internal and external risk assessments designed to help identify material cybersecurity risks to our critical systems and information; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our network may be the target of potential cyber-attacks and other security breaches that could have significant negative consequences."


text: The Audit Committee of our Board of Directors is tasked with oversight of the Company network and data security efforts and is responsible for the Company's policies and practices with respect to cybersecurity and enterprise risk management. We have a dedicated Cybersecurity Engineer in our Information Technology department who reports directly to the CIO. Our Cybersecurity Engineer is primarily responsible for continuously evaluating our security efforts and coordinating with our CIO and other management employees as necessary. The CIO meets with our Audit Committee regularly to update the Audit Committee on any new or identified cybersecurity threats, the Company's cybersecurity efforts and plans for the upcoming quarters. Our Audit Committee also meets regularly with senior management, including our CIO, to receive updates and about the Company's cybersecurity initiatives.


text: Our CEO regularly meets with our CIO to discuss, in part, any significant cybersecurity issues. In addition to the CIO, our Cybersecurity Engineer and the Information Technology team are responsible for the day to day monitoring of the cybersecurity landscape, the Company's monitoring and response processes and training of Company employees. The Chief Legal Officer, Vice President of Network Strategy and VP of Network Engineering may also be involved, as necessary.


text: Our CIO's experience includes over twenty years of experience in risk management and compliance, incident response, crisis management and security architecture and technology integration. Our Cybersecurity Engineer is a certified information systems security professional by the International Information System Security Certification Consortium, and his experience includes cybersecurity architecture, engineering and administration together with the development of cybersecurity policies, practices and training.


text: As a heavily regulated financial services company, the Company has developed a comprehensive cybersecurity process that is designed to protect the security of confidential information. Two of the more significant risks to the Company, both in terms of financial and reputational harm, are a data security breach and/or ransomware attack which cause a material financial loss to the Company and/or materially harms its operational integrity or reputation with its customers as a safe and trustworthy institution. In order to mitigate this risk and comply with the regulatory standards required by the Company's and the Bank's regulators, the Company has developed a cybersecurity program and framework which is administered by a team of experienced professionals and supported by external technology and consulting services. Set forth below is an overview of the Company's cybersecurity process, the role of management and the Board, and whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Process and Management's Role Management is responsible for designing and implementing policies, processes and procedures and deploying physical and virtual technology and safeguards to measure, monitor and control cybersecurity risk. The primary executives responsible for the oversight of risk and cybersecurity are the Company's Chief Risk Officer, who has over 36 years of experience in the banking industry, including 25 years as a national bank examiner for the Office of the Comptroller of the Currency, and the Company's Chief Information Security Officer ("CISO"), who has an educational and experiential background in information technology and information security for public companies (bachelors degree in computer science and service as the Company's CISO for the past nine years, with 10 prior years of information technology and information security experience). The CISO leads the members of the Information Security Department, some of whom maintain a variety of certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Security+ (Plus) Certification (SEC+). Both of these executives, along with the other professionals in the Information Security and Information Technology Departments, have the appropriate knowledge and expertise to effectively assess and manage the Company's cybersecurity risk and establish a system of internal controls in an effort to safeguard the Company's network and comply with regulatory requirements.


text: The Company's cybersecurity framework includes an assessment of the Company's hardware, software, and data platforms across its lines of business, as well as the risks associated with the Company's business, identification of areas inside and outside of the Company that expose it to cybersecurity threats, and employing policies, systems and safeguards to manage those cybersecurity risks. The Company's CISO is responsible for identifying systems and security measures that reflect the appropriate safeguards designed to protect the Company's infrastructure and information and has implemented the majority of current cybersecurity controls in place with an emphasis on the confidentiality, integrity and availability (CIA) triad and a defense in depth methodology. The CISO uses a variety of threat intelligence resources, including law enforcement and industry groups such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), to help stay informed about current and emerging risks to the Company.


text: The CISO is also responsible for supervising and monitoring certain outside professionals or third party service providers that assist in enhancing the Company's current cybersecurity safeguards. The Company has invested meaningful resources to address cybersecurity threats and partners with leading technology companies to implement solutions to address the fast-evolving threat landscape. These solutions and services help with the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.


text: The Company's Internal Audit Department further assists the Company to ensure that the proper safeguards are in place to protect the Company's information by conducting internal audits on certain aspects of the information security program. Internal Audit engages professionals that specialize in information security to review and provide an annual examination and report on the sufficiency of the Company's cybersecurity process and information security program. The Company's independent public accounting firm also performs audit procedures regarding the information security program. In addition, the Company's and the Bank's regulators review and assess the Company's information security program on an annual basis.


text: The Company also maintains certain management committees that further assist in the prevention, detection, and mitigation of cybersecurity risks. Specifically, the CISO works closely with the Company's IT Steering Committee which, among other things, reviews the effectiveness of key controls and provides guidance around future initiatives that strengthen the Company's overall security posture. The IT Steering Committee is comprised of key executives such as the President and Chief Executive Officer and Chief Financial Officer, as well as senior employees that specialize in technology and information security, including the Company's CISO, Chief Technology Officer, and Chief Risk Officer, and a representative from the Board. This committee also monitors current events regarding cybersecurity threats to the Company and more broadly to the financial services industry to help the Company make informed decisions around any necessary internal control enhancements or adjustments. In addition to the IT Steering Committee, the IT Subcommittee assists the CISO to prevent, detect, mitigate, and remediate cybersecurity threats and incidents. The IT Subcommittee typically meets quarterly and consists of members of the information technology and information security teams, the Director of Internal Audit, and senior management members of various business units. This committee is responsible for reviewing information technology and information security projects and the threat landscape.


text: Given the importance of maintaining the security of the Company's systems and information, cybersecurity risks are also reviewed and addressed relative to assessing new products and services and any third party services providers that may be engaged to provide systems and services to the Company. As an essential element of the Company's cybersecurity program, the Company maintains a third party service provider management program that assesses and addresses the risks associated with third parties providing systems, software and programs that access the Company's information. As part of this oversight, the Company's Risk Management, Legal and/or Information Security Departments review higher risk and material contracts with third party service providers, which includes an evaluation of the cybersecurity risks presented, any safeguards, and service organization controls reports provided by the third parties. Initial and continuing due diligence is also conducted on third party service providers to ensure that they are fulfilling their contractual obligations and satisfying the Company's data security requirements.


text: The CISO is also responsible for monitoring data security incidents at third parties who have access to the Company's information which may impact the Company or its customers if it was compromised. When the Company becomes aware of such events, the CISO engages with the impacted third party service providers to understand the incident, assess the risk that the Company's information was released, and determine methods by which the Company can mitigate the damage, if any, and fulfill its notification obligations to impacted parties.


text: In an effort to remain vigilant against cybersecurity attacks, the Company further provides annual and ongoing training to all of its employees so that they have an understanding and appreciation of the cybersecurity environment and risks and the Company's policies to combat such risks. Such training includes annual mandatory training sessions on cybersecurity for all employees, periodic informational notices regarding emerging threats, and periodic testing to ensure employees are reporting suspicious activities and are diligent in their efforts to avoid phishing attacks and cybersecurity breaches. The CISO also conducts and participates in annual table top exercises with management and on occasion, with representatives from the Board, in order to be prepared in the event of a material cybersecurity event.


text: The Company's cybersecurity process and its ability to assess, manage, and remediate cybersecurity risks further centers around good communication among management. Management stays informed on cybersecurity risks through open communication with the Risk Management team, including through various reports and weekly reporting by the Chief Risk Officer to the Senior Management Committee about cybersecurity matters, as necessary. In the event there is a material cybersecurity incident, the Company's policies and procedures set forth an action plan, which includes notification of the appropriate personnel and management within the Company, as well as regulators and impacted customers, as applicable.


text: Board of Directors' Role in Cybersecurity An integral part of Company's risk management oversight, which includes information security, is the role of the Board. This is reinforced by the independence and reporting structure of the Chief Risk Officer, who oversees the CISO and reports to the Board Risk Committee and administratively to the President and Chief Executive Officer.


text: In addition, cybersecurity risk is a fundamental risk of the Company which is overseen by the Risk Committee of the Board, which consists of the entire Board, including Directors with experience in risk management, internal audit, cybersecurity and/or the operations of financial service companies. In particular, the Chair of the Board, Eric E. Stickels, has experience with the risks associated with operating a financial institution based upon his prior service as the President of Oneida Financial Corp. In addition, Lead Director Susan E. Skerritt, the former Chief Executive Officer and President of Deutsche Bank Trust Company Americas, has received the Cyber-Risk Oversight Certification issued by the National Association of Corporate Directors ("NACD"), and utilizes her business experience and cyber-risk expertise to assist the Risk Committee in its evaluation of management's cybersecurity process. Kerrie D. MacPherson, the Chair of the Audit Committee, has also received the Cyber-Risk Oversight Certification issued by the NACD. Mark E. Tryniski, the Company's former President and Chief Executive Officer, serves on the Board and has considerable experience in the management of financial service companies and the cybersecurity process based upon his service with the Company. Director Jeffery J. Knauss has also been selected by the Board to serve on the IT Steering Committee as its representative due to his technology experience developed through his ownership and management of a digital marketing firm. Director Knauss plays a valuable role in the oversight of the IT Steering Committee and is able to impart his knowledge and experience to the committee.


text: The Risk Committee meets six times a year during which management provides updates to the committee regarding the material risks facing the Company. As part of this reporting, the Chief Risk Officer and the Risk Management Department have created a risk management program that identifies and evaluates the risks associated with various aspects of the Company's business and report their assessments to the Risk Committee for review or approval. Within the risk management process, cybersecurity risks are specifically reviewed and addressed, including risks related to current or proposed products and services to be offered by the Company, as well as the efforts taken or to be taken to mitigate such risks.


text: In addition, on at least a quarterly basis, the CISO presents an Information Security report to the Risk Committee, which includes the Company's cybersecurity alert level, controls rating, current and emerging cybersecurity risks, threats and trends, mitigation efforts and projects and audit and regulatory updates.


text: On an annual basis, the Board's Audit Committee also receives reports from outside consultants who perform various IT related audits, and the Company's independent registered public accounting firm regarding the effectiveness of the Company's cybersecurity program in connection with its review of the Company's financial statements.


text: Risks Associated with Cybersecurity The Company is often targeted in an effort to obtain unauthorized access to its financial records and confidential information, destroy data, disable or degrade service, or sabotage systems. Such attacks may take various forms, including the introduction of computer viruses or malware, ransomware, phishing attacks, cyber-attacks, or breaches due to errors or malfeasance by employees, contractors and others who have access to or obtain unauthorized access to the Company's systems and networks. To date, these threats and attacks have not resulted in a material cybersecurity incident. However, a material failure, interruption or security breach could adversely affect the Company's business and operations through financial losses, remediation expenses, reputational damage, as well as exposing the Company to customer dissatisfaction and civil litigation, regulatory fines or penalties or losses not covered by insurance. For more information on risks to the Company from cybersecurity threats, see "Risk Factors – Operational Risks".


text: In general, cybersecurity incidents can result from deliberate attacks or unintentional events such as a cyber-attack against USCF, a natural catastrophe, an industrial accident, failure of the Trust's disaster recovery systems, or consequential employee error. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of a fund's clearing broker or third party service provider (including, but not limited to, index providers, the administrator and transfer agent, the custodian), have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of fund shareholders to transact business, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: The Trust does not have computer systems or networks. Pursuant to the terms of the Trust Agreement, the Trust's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on the Trust, USCI and CPER. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. The risk assessment aims to confirm that USCF's policies are being followed and enforced, and to identify risks that may have otherwise been unknown. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and the Trust.


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Trust Series, including its business strategy, results of operations, or financial condition.


text: The Director of Compliance, as identified below, provides regular reports to USCF's Board of Directors on developments to the information security and cybersecurity risks facing the Trust. Reports may include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to the Trust.


text: In general, cybersecurity incidents can result from deliberate attacks or unintentional events such as a cyber-attack against USCF, a natural catastrophe, an industrial accident, failure of USL's disaster recovery systems, or consequential employee error. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of a fund's clearing broker or third party service provider (including, but not limited to, index providers, the administrator and transfer agent, the custodian), have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of fund shareholders to transact business, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: USL does not have computer systems or networks. Pursuant to the terms of the LP Agreement, USL's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on USL. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. The risk assessment aims to confirm that USCF's policies are being followed and enforced, and to identify risks that may have otherwise been unknown. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and USL.


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect USL, including its business strategy, results of operations, or financial condition.


text: The Director of Compliance, as identified below, provides regular reports to USCF's Board of Directors on developments to the information security and cybersecurity risks facing USL. Reports may include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, and management's evaluation of cybersecurity risks material to USL.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Concord Acquisition Corp II

ticker: CNDA


text: We recognize the importance of developing, implementing and maintaining a firm cybersecurity posture to safeguard our information systems, protect the confidentiality, integrity and availability of our data and mitigate risks associated with cyber threats and attacks.

companyName: INNODATA INC

ticker: INOD


text: We are ISO/IEC 27001:2013 certified and the ISO Information Security Risk Management Standard is used as a reference guide for our risk management approach. We have a designated Chief Information Security Officer (CISO) who has primary responsibility for managing our cybersecurity risks. Our CISO has more than 28 years of experience in Information Security and holds a master's degree in Information Technology. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO is assisted by a team of Information Security Officers (ISOs) and a third-party consultant who has expertise in cybersecurity, information security risk management, and information systems audit and holds various certifications including, CISA, CISM, HITRUST Certified Common Security Framework Practitioner, QSA, and CSP.


text: Recognizing the inherent cybersecurity risks common to any organization, encompassing concerns such as unauthorized access to sensitive data, potential disruptions to business operations from cyber incidents, and the associated financial and reputational impacts arising from a cybersecurity breach, we have implemented comprehensive policies covering various aspects of cybersecurity and information management, including, without limitation, cyber risk management, information security practices, roles and responsibilities, access controls, cryptography, information classification, asset disposal, and vendor management. We periodically review and modify these policies to align with industry practice, trends and evolving threat landscapes. Compliance with these policies is expected from all employees and contractors.


text: We perform periodic assessments for identifying threats and vulnerabilities, covering relevant operational facets, and focusing on identifying, analyzing, evaluating, and treating cyber risks across business functions. Our risk assessment guidelines define risk measurement and prioritization, and consider factors such as likelihood, impact, and potential harm. Mitigation strategies are planned, covering technical and procedural measures, including incident response plans.


text: We maintain a comprehensive incident response plan. Key components include regular updates to ensure effectiveness, employee training programs, and establishing communication channels and relevant systems for proper incident reporting and logging procedures. Communication and notification protocols are defined for notifying third parties such as regulatory bodies, customers, and partners. Recovery strategies are developed for restoring normal operations, and post-incident analysis is conducted to identify lessons learned and improvements for future incident response efforts. The incident response plan also outlines procedures for prompt detection, response, and remediation efforts to minimize the impact of incidents.


text: Incident materiality is assessed through a collaborative process involving key personnel within our organization. Responsibility for conducting a materiality assessment lies with our management team, in consultation with advice from our third-party cybersecurity consultant, as appropriate. The materiality assessment considers various factors, including financial impact, reputational risk, regulatory implications, and potential harm to third parties. Upon completion of the materiality assessment, the disclosure of incidents, including those related to contractual, regulatory, or technology/security aspects, is handled by designated members of our senior management team. We consult with outside counsel or experts as appropriate, including on materiality analysis and disclosure matters.


text: As of the fiscal year ending December 31, 2023, there have been no identified cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Engagement of Third Parties Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged a third-party consultant to assist with evaluating and testing our risk management approach. This enables us to leverage specialized knowledge and insights in connection with our cybersecurity strategies and processes.


text: To enhance our current cybersecurity posture, we continue to invest in advanced threat detection technologies, provide cybersecurity training based on the latest trends and guidance to the employees, collaborate with industry partners and regulatory bodies to stay informed about emerging threats, reinforce our cybersecurity incident response plan to align with industry-specific regulations and legal obligations, integrate threat intelligence feeds for automatic detection of any misconfigurations, security threats, and foster a collaborative, cross-functional, and accelerated approach to incident response.


text: Our Board of Directors is aware of the critical nature of managing the risks associated with cybersecurity threats. The Board of Directors has established oversight mechanisms to ensure effective governance in managing these risks.


text: Board of Director Oversight Our Audit Committee has primary responsibility for overseeing risk management, including with respect to cybersecurity. The Audit Committee monitors management's compliance, and reports to the Board of Directors. The CISO, who is responsible for developing our cybersecurity strategy and managing our cybersecurity risks, reports directly to the Audit Committee on these matters.


text: Our cybersecurity governance framework incorporates policies, procedures, regular meetings, and controls to manage and mitigate cybersecurity risks. Aligned with industry standards and regulatory requirements, the framework is overseen and regularly evaluated by our leadership team responsible for implementation. Regular risk assessments are conducted to identify and assess potential cybersecurity risks, informing the development of proactive risk mitigation strategies within the governance framework.


text: The governance framework is closely integrated via a structured compliance reporting framework operating across various governance levels. This framework also operates across geographic locations, with location specific compliance meetings conducted at a local management level and led by the CISO with assistance from the ISO team. This structured compliance reporting is intended to ensure that the highest levels of management are kept abreast of potential cybersecurity risks facing the Company, with the escalation of significant cybersecurity matters to the Audit Committee and ultimately to the Board of Directors, as appropriate.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees or customers violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. The Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: NORTHWEST BIOTHERAPEUTICS INC

ticker: NWBO


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients and clinical trial participants, sensitive third - party information and employee information.

companyName: SEELOS THERAPEUTICS, INC.


text: We have implemented a cross - functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events.


text: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti - malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. We use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi - factor authentication, perform regular penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices.


text: We have established and maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. We conduct regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: We maintain a risk - based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third - party systems, including any outside auditors or consultants who advise on our cybersecurity systems.


text: We provide regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. The Audit Committee of our Board oversees management of risk, including cybersecurity and the management of cybersecurity threats. This committee meets regularly with the Company's management and reports to the full Board. Management is responsible for the day - to - day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are integrated into our overall risk management system and processes. In general, we seek to address material cybersecurity threats through a company - wide approach that addresses the confidentiality, integrity, and availability of our information systems or the information that we collect and store, by assessing, identifying and managing cybersecurity issues as they occur. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre - established reporting thresholds, as well as ongoing updates regarding any such risk. Our CEO and CFO each have over 25 years of experience managing risk at the Company and at similar companies.


text: Other than as disclosed in Part I, Item 1A "Risk Factors" above, including, without limitation, the risk factor under the heading "We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively", risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: AUDIOEYE INC

ticker: AEYE


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through an internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our products) and implement appropriate changes.


text: We have implemented incident response processes in the event of a cybersecurity threat. Such incident responses are overseen by functional leaders and internal experts. In the event of a cybersecurity threat, security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for potential privacy impact. As part of the above processes, we have engaged external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards, and we are in the process of obtaining a SOC 2 Type II report.


text: We describe whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security and privacy breaches, computer viruses, and cyber-attacks could harm our business, financial condition, results of operations, or reputation." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cyber and data security threats. Members of the Board or Audit Committee receive periodic updates from senior management regarding our cybersecurity processes and risks. Members of management that comprise our incident response team include the following officers (or those with similar responsibility): Senior Director of Information Technology, Vice President of Engineering, Chief Financial Officer, General Counsel, Customer Success (if customer data is affected), and Vice President of Human Resources (if employee data is affected). As part of our internal response policy, upon confirmation of a breach, a remediation process is initiated, led by our Principal Privacy Officer who chairs an incident response team. This team may include members from relevant departments such as Product Development, Information Technology, Finance, Legal, Marketing, Client/Customer Services and Human Resources, any other relevant units or departments affected by the breach and any additional personnel as deemed necessary.


text: The Principal Privacy Officer is responsible for overseeing the determination of whether a breach occurred, coordinating with third parties handling protected information, and ensuring compliance with legal obligations. Forensic investigators, provided through AudioEye's cyber insurance or as deemed necessary by the Principal Privacy Officer, will analyze the breach to understand its cause and extent. A communication plan will be developed by Marketing, Legal, and Human Resources to inform internal employees, the public, those directly affected, and regulatory authorities, as necessary to help ensure all notifications comply with relevant laws and regulations.


text: The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by our Board of Directors, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impacts from cybersecurity threats and incidents, escalating to management and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: We use specialized IT tools and services, including with the support of third-party service providers, to understand, manage, mitigate and continually remediate identified risks. The Company logs identified cybersecurity risks and tracks corresponding risk management activities. Identified cybersecurity risks are discussed with management for resolution planning and escalation.


text: Testing of our security controls in connection with the auditing of our financial systems is completed annually. At least annually, we conduct training and awareness for our employees to help identify, avoid and mitigate cybersecurity threats.


text: We regularly evaluate the cybersecurity risks associated with third-party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third-party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we week to make third-party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While we have implemented a cybersecurity program, the techniques used to compromise IT systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A – Risk Factors."


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The CEO and CFO report on cybersecurity matters, including material risks and threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors.


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention any material risks. Under the oversight of the Audit Committee, the Company's Chief Executive Officer is primarily responsible for the assessment and management of cybersecurity risks and utilizes third-party consultants retained by the Company for advice.


text: The Company recognizes the critical importance of developing, implementing, and maintaining good cybersecurity measures to safeguard its information systems and protect its data's confidentiality, integrity, and availability.

companyName: ELECTRAMECCANICA VEHICLES CORP.


text: As part of the Company's overall risk management system, the Company has diligently protected and secured physical, virtual, and cloud assets. To defend against cybersecurity incidents, the Company has implemented cybersecurity monitoring tools for its virtual and cloud environments to monitor network traffic within the Company for abnormalities and for any potential intrusions. For the Company's user devices, the Company has implemented a software-based Zero-Trust virtual private network (VPN) and a software-based firewall to ensure the Company's data is protected. Additionally, the Company has deployed monitoring systems, multifactor authentication (MFA), and single-sign-on (SSO) to ensure user accounts are protected from external cybersecurity threats. The Company regularly monitors third-party service providers, such as those that provide cloud-based and VPN services, to identify and mitigate risks from cybersecurity threats.


text: Risks from Cybersecurity Threats As of the date of this filing, the Company has not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. The Company's strategy is to mitigate risks preventatively; however, no assurances can be provided that there will not be incidents in the future or that they will not materially affect the Company.


text: The Company's Board of Directors is responsible for identifying the principal risks of the Company's business and ensuring that those risks are effectively managed. The Company's Chief Information Officer is responsible for assessing and managing the Company's risks from cybersecurity threats and has approximately 15 years of prior work experience in roles involving information technology. The Chief Information Officer is informed about, and monitors the prevention, detection, mitigation and remediation of, cybersecurity incidents through his management of, and participation in, the monitoring systems and processes described above. The Chief Information Officer reports information about such risks to the Company's Chief Executive Officer, Chief Financial Officer and General Counsel, who then would report information to the Company's Board of Directors. When appropriate, the Chief Information Officer would be invited by management to present information to the Company's Board of Directors.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: As previously discussed in "Item 1. Business" the Partnership is managed by GPB, through its affiliation with Highline. Among the services provided to the Partnership under the MSA is a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Partnership's enterprise risk management system as administered and overseen by Highline and addresses the corporate information technology environment.

companyName: GPB Automotive Portfolio, LP


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements.


text: Highline partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise, including secure cloud storage solutions, firewalls and monitoring software. Highline engages with these partners and their technology to monitor and maintain the performance and effectiveness of its corporate information environment.


text: Highline has a dedicated specialist who oversees Highline's cybersecurity efforts on behalf of all of its clients. This specialist is responsible for assessing and managing Highline's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity specialist has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Highline.


text: The Board oversees the Partnership's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity specialist briefs the CEO, who presents to the Board annually, on the effectiveness of the Partnership's cyber risk management program and any potential cybersecurity threats. Cybersecurity risks are reviewed by the Board, at least annually, as part of Highline's corporate risk mapping exercise.


text: The Partnership faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Partnership has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Partnership's business, financial condition, results of operations, or cash flows. See "Item 1A. Risk Factors – Risks Related to the Partnership and Plan of Liquidation – Breaches in our data security systems or in systems used by our vendor partners, including cyber-attacks or unauthorized data distribution by employees or affiliated vendors, or disruptions to access and connectivity of our information systems could impact our operations or result in the loss or misuse of customers' proprietary information" for more information about the cybersecurity risks the Partnership faces.


companyName: Bite Acquisition Corp.


text: Cybersecurity and Risk Management The Company's cybersecurity risk management processes are integrated into the overall risk management process managed by the Chief Risk Officer through reporting of cyber risks to the Information Security Steering Committee (ISSC). The ISSC is chaired by the Managing Director of Information Security, who has 17 years of information technology (IT) and information security experience in the financial services industry. Key metrics are monitored on an ongoing basis by the IT Risk Management and IT Security teams, with oversight by the ISSC. IT Risk Management performs regular information security-focused risk assessments, including but not limited to assessments based on the Center for Information Security Controls Self-Assessment Tool and Ransomware Self-Assessment Tool aligned to the Federal Financial Institutions Examination Council standards.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: IT Risk Management maintains processes for prevention, detection, and mitigation of cybersecurity incidents. The Company maintains an Incident Response Plan (IRP) that covers response and remediation processes for managing cybersecurity incidents. The Incident Response Team (IRT) members include senior management and other relevant personnel, with defined roles and responsibilities. IRP metrics related to monitoring and detection are presented to the ISSC and reported to the board. The IRT is notified of all incidents, and incidents are elevated to the board when warranted.


text: Engagement of Third Parties The Company utilizes third parties for some cybersecurity services, including but not limited to managed security services, external and internal penetration testing, social engineering tests, third party risk reviews and tabletop exercises.


text: Oversight and Identification of Risks Associated with Third Parties Third Party Risk Management, a component of IT Risk Management, reviews new vendors prior to onboarding to oversee and identify potential risks and performs ongoing monitoring of emerging risks related to third-party service providers. Third-party service provider reviews include completion of a standardized questionnaire and risk reviews for financial, reputation, information security, cybersecurity, and business resiliency risk. These reviews are reported to the Information Technology Steering Committee (ITSC) for approval of new applications. The ITSC is chaired by the Chief Information Officer, who has more than 20 years' experience in IT management and cybersecurity, predominantly in the financial services industry. IT Risk Management performs contract reviews for security controls and notification processes. IT Risk Management also conducts annual IT risk assessments on critical and high risk applications.


text: Risks from Cybersecurity Threats In the last fiscal year, the Company did not experience any material cybersecurity incidents. For additional discussion of cybersecurity-related risks facing the Company, see Item 1A. Risk Factors.


text: In connection with the board's oversight of risk management, cybersecurity updates are provided to the board at least quarterly, including, but not limited to, the following materials: Annual Gramm-Leach-Bliley Act Information Security Program (ISP) Report, IT Risk Management and IT Security Metrics, Penetration Testing and Tabletop Exercise updates, IT Risk Assessments, Disaster Recovery Test Results, Third Party Risk Management Metrics, Incident Response Metrics, Security Awareness Training Metrics and additional cybersecurity education topics.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, incoming (external) physical infrastructure with enhanced firmware, continuous employee training, internal reporting, and monitoring and detection tools. We also engage top third-party security providers for applications and infrastructure to identify, prioritize, assess, mitigate, and remediate risks.


text: Our information technology ("IT") department regularly assess risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including but not limited to tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident, (iii) containment, eradication, and recovery, and (iv) post-incident analysis. Such incident responses are overseen by our Leadership Committee comprised of our Chief Operating Officer, Chief Financial Officer, General Counsel and Senior Vice President of FP&A.


text: Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: As part of the above processes, we regularly engage external resources and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from key third parties such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: Management has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors, " We are highly dependent on information systems and therefore systems failures, cybersecurity incidents or other technology disruptions could negatively impact our business" and "Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer." above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers.


text: Our Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board and through its committees. The Audit Committee meets annually to review enterprise security, technology risks and cybersecurity threats, risk assessments and areas of emerging risks, incidents and mitigation strategies, and industry trends.


text: Our IT department maintains internal and external resources and is led by our IT Manager and assisted by our Risk Assessment/IT Compliance & Enterprise Manager. These two individuals have a combined 40+ years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. The IT department is responsible for the information security of the organization and for the oversight of all cybersecurity infrastructure and programs. The department provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: Our Leadership Committee is responsible for the oversight of risks from cybersecurity threats. The Leadership Committee receive updates on a quarterly basis from leaders of our IT department and compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status on key information security initiatives. Our Leadership Committee and IT department discuss cybersecurity-related current events and any updates to our cybersecurity risk management and strategy programs.


text: Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: ConnectM Technology Solutions, Inc.

ticker: CNTM


text: We depend on a variety of information systems and technologies (including cloud technologies) to manage our business. We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: Quoin Pharmaceuticals, Ltd.

ticker: QNRX


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken, to conduct an annual assessment of our cyber risk management program and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. Our cybersecurity risk management strategy and infrastructure includes maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.


text: Our management team is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants who may be engaged by us for strategic cyber risk management, advisory and decision making. To the extent we utilize third-party vendors to provide information technology services for various areas, including human resources functions (e.g., payroll), we generally require these vendors to monitor and protect their information technology systems against cyber-attacks and other breaches. The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Member(s) of management brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems, and those that we offer to our customers are necessary for the operation of our business. We use these systems, among others, to manage our customer and vendor relationships, for internal communications, for accounting to operate record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training, and penetration testing.


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our full Board oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. The Board receives regular presentations and reports from management who are responsible for managing and assessing cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its Director of IT, who reports to the CFO. The qualifications of the Director of IT include over 25 years of IT management, cybersecurity, and information governance experience. The Director of IT is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Management's role includes:


text: Risk Assessment: Management conducts annual cybersecurity risk assessments to identify and evaluate potential threats and vulnerabilities. Management considers the likelihood and potential impact of various cybersecurity risks, considering the Company's assets, systems, and operations, to prioritize mitigation efforts.


text: Management reviews and approves the Company's cybersecurity policies and procedures and communicates these policies and procedures to all employees to ensure adherence to established security protocols. Compliance with Regulations: Management implements and maintains compliance with relevant cybersecurity regulations and standards applicable to the Company.


text: Management reviews budgets for cybersecurity initiatives and ensures that adequate resources are allocated to address cybersecurity risks and that investments in cybersecurity align with the Company's risk tolerance and strategic objectives.


text: The Director of IT is promptly informed of potential cybersecurity risks, threats, and vulnerabilities by the Company's IT Helpdesk. Once an incident has been identified, the Director of IT and the IT network security team assess the criticality and impact of the incident on the Company's business operations. The Director of IT then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the senior leadership on all material incidents.


text: We recognize the importance of managing the material risks of cybersecurity threats, and we have implemented processes for identifying and assessing cybersecurity risks and incidents. We have also integrated these processes into our overall risk management system, including senior management's periodic reviews of cybersecurity risks or threats. Senior management oversees and works closely with our IT department to continuously review and evaluate cybersecurity risks in alignment with our business goals and needs.

companyName: Cytosorbents Corp

ticker: CTSO


text: With respect to cybersecurity risks and threats, we utilize various third-party consultants and advisors to assist us with regular reviews, internal audits and best practices, including threat prevention and detection, security reviews and enhancements, penetration testing and full scope IT audits. CytoSorbents also has strict processes in place for the review of third-party service providers engaged, including thorough security assessments before engagement and annual monitoring of their IT environments and controls.


text: Our Chief Executive Officer and Chief Financial Officer are primarily responsible for timely updating the Board of Directors and the Audit Committee of the Board of Directors (the "Audit Committee") about any material cybersecurity incidents or threats or any cybersecurity related issues worthy of their attention.


text: Our Board of Directors has designated the Audit Committee as the primary committee responsible for reviewing and managing cybersecurity risks and threats at CytoSorbents. The Audit Committee is comprised of members of the Board of Directors with diverse experience in healthcare, finance and information technology, enabling them to effectively oversee cybersecurity risks and threats. Our management team, with assistance from third-party consultants or advisors as appropriate, provides quarterly updates regarding cybersecurity risks and threats to the Audit Committee and ad hoc updates or communications are provided to the entire Board of Directors as needed.


text: The IT Operations team is primarily responsible for the timely identification, review, severity assessment and management of cybersecurity incidents. In the event of a cybersecurity incident, the IT Department leadership follows the procedures outlined in our Cybersecurity Incident Response Policy and works closely with management to form a Security Incident Response Team comprised of members from the appropriate functional teams. In accordance with this policy, senior management will also communicate the occurrence of any significant cybersecurity incidents to our Board of Directors, Audit Committee and auditors on a timely basis and will keep them informed of the remediation plans and progress.


text: We review cybersecurity risk as part of our overall enterprise risk management program. This ensures that cybersecurity risk management remains a top priority in our business strategy and operations.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel.


text: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.


text: We have processes in place to identify, review and evaluate cybersecurity risks associated with our use of third-party service providers. These reviews are conducted at onboarding and periodically throughout the tenure of the service provider based on risk tier rating of each service provider. We believe these processes enable us to evaluate a third-party service provider's security posture, identify risks that may arise out of our use of the third party's service, and make decisions regarding acceptable levels of risk and risk mitigation.


text: Our Company is proactive in managing the material risks from cybersecurity threats, which is reflected in the establishment of a dedicated committee responsible for overseeing such risks. This committee is composed of the following individuals: Kamran Shamaei, Chief Technology Officer, who provides technical leadership and strategic direction for all technology-related decisions, including cybersecurity.


text: Muhammad Afnan, Director of Software Development, who brings extensive knowledge in software security practices and the implementation of secure development life cycles.


text: Nisha Patel, Director of Quality & Regulatory Affairs, whose expertise in regulatory compliance ensures that our cybersecurity policies meet the required standards.


text: This cross-functional team possesses a comprehensive understanding of cybersecurity, data privacy, and risk management, essential in developing, monitoring, and enforcing our cybersecurity strategy.


text: Processes for Monitoring Cybersecurity Our cybersecurity oversight committee maintains rigorous processes to remain informed and responsive to the ever-changing landscape of cybersecurity. These processes include: The creation and management of secure user accounts within our Monogram email Google Workspace, ensuring controlled email communication. The establishment of access controls to Google Drive and Bitbucket, safeguarding our product-related documents and software development repositories. Subscription to Amazon Web Services for secure storage of our mechanical drawings and electrical schematics. Utilization of Green Light Guru for maintaining a repository of all released and quality documents. Oversight of bill.com and NetSuite for financial operations and inventory management, ensuring secure financial transactions and data integrity.


text: These processes are under continuous review and adjustment, with the committee meeting quarterly to evaluate and refine our cybersecurity practices.


text: Reporting Cybersecurity Information In terms of reporting, the structure of our cybersecurity information flow is designed to ensure that significant risks and incidents are communicated efficiently to senior management and the board of directors:


text: The Software Director, Platform Tech Manager, and dedicated admin for Green Light Guru report directly to Kamran Shamaei, the CTO.


text: The committee convenes on a quarterly basis to discuss the current state of cybersecurity affairs, subsequently reporting their findings to the CEO and CFO.


text: In the event of any concerns or breaches, these are immediately escalated to Paul Riss, ensuring prompt and effective response and mitigation strategies.


text: Through this tiered reporting structure, we ensure that critical cybersecurity information reaches the appropriate levels of management and that the board of directors is kept fully informed on material risks and incidents. Our approach ensures that we maintain a vigilant and responsive posture towards cybersecurity, embodying a culture of continuous improvement and accountability at all levels of our organization.


text: As a shell company with no current business or operations, we do not have an established processes to oversee and identify material risks from cybersecurity threats nor any board committee or subcommittee responsible for the oversight of risks from cybersecurity threats.

companyName: THEGLOBE COM INC

ticker: TGLO


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with Information Technology controls; user and employee awareness of cyber policies and practices; information systems configuration management; infrastructure security systems; and cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third - party service providers. We also engage a range of third - party experts in connection with various security implementation, and maintenance activities related to our cybersecurity program.

companyName: CYPHERPUNK TECHNOLOGIES INC.

ticker: CYPH


text: Our cybersecurity program is integrated into our overall risk management systems, business continuity and incident response plan. As part of our overall risk management program, we maintain an insurance portfolio with comprehensive cyber coverage. Our Director of Information Technology consults with third - party security advisors and provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.


text: While our audit committee has oversight responsibility for risk management generally, the Director of Information Technology is specifically responsible for overseeing our cybersecurity program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. Our Director of Information Technology provides periodic updates to senior management in this regard and covers the state of our cybersecurity program to information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents of interest, including those associated with our third - party service providers. The board of directors will be informed promptly of material risks from cybersecurity threats.


text: We strive to create a culture of cybersecurity resilience and awareness and believe that cybersecurity is the responsibility of every employee and contractor. At the same time, primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our Director of Information Technology.


text: We recognize the importance of cybersecurity in our operations. We face diverse cybersecurity threats, ranging from unauthorized individual access attempts to sophisticated disruptions targeting our business and customer data. Our operations involve collecting and storing customer information in cloud systems, such as Google Drive, and we rely on third-party providers, such as Google, whose systems may encounter interruptions and/or cybersecurity incidents.

companyName: CHEETAH NET SUPPLY CHAIN SERVICE INC.

ticker: CTNT


text: Our business depends on the continuous functioning of our OA System, which tracks order status and monitors business workflows. The secure handling of information is crucial, particularly for tracking automobile orders. We have implemented various measures, such as access controls, data encryption, and vulnerability assessments, to prevent and mitigate cybersecurity risks and incidents. In particular, we have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, which is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. We have developed a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also developing tools and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including Squarespace and Google Workspace, which assist us with information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. We engage in the assessment and testing of our cybersecurity risk management program, policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate. However, cybersecurity incidents, if they occur, depending on their nature, could lead to the loss, destruction, or unavailability of critical and confidential data, impacting our operations and potentially harming our reputation. This could result in customer distrust, termination of partnerships, significant remediation costs, and legal liabilities.


text: As of the date of this annual report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating and Corporate Governance Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee receives reports from management on potential cybersecurity risks and threats. Our management plays a key role in assessing and managing our material risks from cybersecurity threats, with designated positions and committees equipped with the necessary expertise. The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel and threat intelligence and other information obtained from governmental, public, or private sources.


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of the data we use in our business, as well as our employee and clinical data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: We continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies.


text: The Company's Chief Operating Officer (COO) assumes a pivotal role in overseeing the cybersecurity risk management program. The COO collaborates with business leaders on the matters of cybersecurity across the Company.


text: Cybersecurity risks fall within the purview of the Audit Committee and, ultimately, the Board of Directors. Regular oversight and reviews occur at established intervals. The Audit Committee engages in discussions with the COO and Company management at least once a year, covering various aspects of cybersecurity risk management, including recent developments, evolving standards, vulnerability assessments, and the threat environment.


text: We measure our data security effectiveness by benchmarking against industry-accepted methods and we work to remediate any significant findings. We maintain and routinely test backup systems and disaster recovery and also have processes in place to prevent disruptions resulting from our implementation of new software and systems.


text: We have a comprehensive incident response plan to address cybersecurity incidents. Our incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting our information technology. To date, we believe that our cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of its information however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. Further, we currently maintain a cyber insurance policy that provides coverage for security breaches however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.


text: We engage external parties, including consultants, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we also have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners, which includes certification of our major technology suppliers and any outsourced services through accepted security certification standards.


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, we have not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2023. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure.

companyName: UNITED BANCORP INC /OH/

ticker: UBCP


text: Legal Overview Pursuant to the requirements of section 39 of the Federal Deposit Insurance Act (12 U.S.C. 1831p–1) and sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801, 6805(b)), the federal bank regulatory agencies adopted the Interagency Guidelines Establishing Information Security Standards (the "Guidelines"). The requirements of the Guidelines apply to all FDIC-insured depository institutions, most subsidiaries of such entities, and to state savings associations. Federal law also mandates that information security procedures and controls be routinely evaluated by the Bank's state and federal regulators as part of the standard safety and soundness examination process.


text: Bank Security Policy To comply with all applicable federal requirements, the Bank's Board of Directors has adopted the Unified Bank Information Security Policy (the "ISP"), which establishes a program that the Bank's management and board can use to: Ensure the security and confidentiality of customer information;


text: Protect against any anticipated threats or hazards to the security or integrity of such information; and Protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer.