text: We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including Microsoft Azure CSPM and SOC 2. We use this framework, together with information collected from periodic manual assessments and automated testing, to tailor aspects of our cybersecurity practices given the nature of our assets, operations and business. The Company's processes to assess, identify and manage material risks from cybersecurity threats include, but are not limited to, the following: • The members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures and provide for continuity of operations. • The Company uses various systems to manage threats, for example, firewall protections, anti-virus protections, vulnerability scans, among others. Such systems are regularly reviewed for adequacy and potential enhancements. • The Company employs an information security and training program for our employees, including regular internal communications and ongoing end-user testing to measure the effectiveness of our information security program. • The Company utilizes a third-party service that provides real-time threat intelligence feeds and global threat data to enhance threat detection capabilities and proactively defend against emerging cyber threats. • We monitor the location of our geographic location of data sent to third party systems.


text: In 2023, we conducted an enterprise risk assessment that included an assessment of cybersecurity risk in context with other enterprise-level risks. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors", of this Annual Report on Form 10-K.

companyName: Volato Group, Inc.

ticker: SOAR

secItem: Item 1C


text: In the last three years, we have not experienced a material information security breach incident, or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data results ("Information Systems and Data").

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: The Company's Senior Vice President of Finance ("SVPF") and Director of Information Technology ("IT") help identify, assess and manage cybersecurity risk, including input from employees, and devote resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. The SVPF and Director of IT identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example maintaining manual and automated tools, conducting scans of threats and actors, evaluating threats reported to us, completing internal and external audits, and completing third-party threat assessments.


text: We have processes and standards to address cybersecurity matters and mitigate material cybersecurity risk. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, encryption standards, access controls, disaster recovery/business continuity plans, incident detection and response, antivirus protection, remote access security, and multi factor authentication. All employees are required to complete cybersecurity trainings at least once a year.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Director of IT along with management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.


text: The SVPF and Director of IT, who has over thirty years of experience in information technology and has both a computer science and information science degree, are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board of Directors. We support our information security program with external resources including cybersecurity software providers and advisors as needed.


text: We have a vendor management processes to manage cybersecurity risks associated with our use of these external providers that includes a risk assessment for each vendor, reviews of vendor audits and reports, and we also impose certain contractual information security obligations on vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.


text: The Board, as part of its general oversight function, participate in discussions with senior management and amongst themselves regarding cybersecurity risks. With the assistance of the Company's most senior IT manager, we review annually the cyber and data security risks of our overall IT environment. We assess cybersecurity risk and the overall environment which includes devices, IT systems, websites, social media accounts, manufacturing technology/systems and suppliers/vendors. The oversight from the Board includes material changes to policies, procedures, employee training and elements of the overall environment, as necessary, senior management provides an update on emerging cyber threats. The Board has access, as requested, to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of senior management, depending on the circumstances. Senior management works with the Company's cybersecurity incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's cybersecurity incident response plan includes reporting to the Board for certain cybersecurity incidents.


text: We face a number of cybersecurity risks in connection with our business. For more information about the cybersecurity risks we face, see the risk factor entitled "We and the third parties that support us rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems could have a material adverse effect on our business, including by not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" in Item 1A- Risk Factors.


text: Managing cybersecurity risks is an important component of the Company's approach to enterprise risk management. Our enterprise risk management approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's and customer's information; and (iv) protect our intellectual property.

companyName: Augmedix, Inc.


text: Our cybersecurity program focuses on the following areas: • Vigilance – We maintain 24/7 cybersecurity threat operations in order to rapidly detect, contain and respond to cybersecurity threats and incidents. • Systems Safeguards – We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, endpoint detection and response software that includes anti-virus and anti-malware functionality, data loss prevention mechanisms, access controls and ongoing vulnerability assessments and penetration testing. • Third-Party Management – We screen vendors, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented to users of our systems. The screening includes conducting sanctions and exclusions checks and security risk assessments. • Education – We provide training at hire and annually thereafter for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices. • Incident Response Planning – We have established and continue to maintain an incident response plan that addresses our response to a cybersecurity incident. We conduct annual testing of our incident response plan to measure effectiveness to improve our plan. • Communication and Coordination – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the technology, operations, legal, risk management and other key business functions (the "Cybersecurity Oversight Team"), as well as including our board of directors in an ongoing dialogue regarding cybersecurity threats and incidents. • Governance – Our board of directors' oversight of cybersecurity risk management is supported by our Compliance and Risk Management Committee, which includes our Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer and interacts directly with, and is provided relevant information by, our Cybersecurity Oversight Team.


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We regularly conduct vulnerability scans and penetration testing both internally and using third party vendors. We also engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures on an annual basis. The assessments include information security maturity evaluations, independent environmental security control reviews, and operating effectiveness. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews. We have been assessed and obtained a HITRUST r2 certification of our production environment.


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our information technology team oversees the day-to-day management of our cybersecurity program with regular reporting to representatives of our Cybersecurity Oversight Team. Our Cybersecurity Oversight Team has overall responsibility of our cybersecurity risk management program and procedures and reports regularly to the Audit Committee of our board of directors on cybersecurity matters. From a governance perspective, the Audit Committee as well as our Compliance and Risk Management Committee are provided with updates from the Cybersecurity Oversight Team regarding incidents as well as the policies, standards, processes and practices that the Company implements to address risks from cybersecurity threats. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, our board of directors will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.


text: The Cybersecurity Oversight Team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our Cybersecurity Oversight Team members each possess at least 5 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training. We believe this collective experience allows us to effectively manage risks emerging from cybersecurity threats.


text: The Cybersecurity Oversight Team works collaboratively across the Company to implement customized programs designed to protect and respond to cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response plan. Chief concerns are reported to our Compliance and Risk Management Committee when appropriate.


text: To date we have not experienced any cybersecurity incident that has materially affected our business, results of operation, or financial condition. We have also not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Although we have adopted various processes and preventative measures with the objective of preventing breaches and minimizing the risks from cybersecurity matters, given the nature of cybersecurity threats which are constantly evolving over time, there is no guarantee that the Company, including its business strategy, results of operations or financial condition, will not be adversely affected by such threats or that our preventative measures and processes will be effective. For further discussion of the Company's risk related to cybersecurity, see the risk factors "Our business and reputation may be impacted by IT system failures or other disruptions" and "If our products experience data security breaches, and there is unauthorized access to our customers' data, we may lose current or future customers, our reputation and business may be harmed and we may incur significant liabilities" in Part I, Item 1A of this Form 10-K.


text: Our risk management program is designed to identify, assess and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cyber security component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Technology Officer, who reports directly to our President and Chief Executive Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing and/or implementing new products, services and technology. We leverage people, processes and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detection tools designed to monitor, block and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems and network architecture, using internal cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Cyber Incident Response Procedure that provides a documented framework for responding to actual and potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees and to the Enterprise Risk Committee of our Board of Directors. The Cyber Incident Response Procedure is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Cyber Incident Response Procedure facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Cyber-attacks or other security breaches could adversely affect our operations, net income or reputation" in Item 1A. Risk Factors.


text: Management Committee Oversight The Company has established an Information Risk Management Subcommittee, chaired by the Chief Information Security Officer and supported by leaders from departments across the Company. The Cybersecurity function is provided by qualified financial service technology professionals, with extensive certifications and/or advanced degrees in cybersecurity. Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution. The subcommittee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats. Policies are also shared with the Enterprise Risk Management Committee to provide an additional second line review in alignment with Enterprise Risk functions. All Information Security activity is lead by the Chief Information Security Officer, which includes developing and implementing the information security program and reporting cyber security matters to the Board. The Chief Information Security Officer has many years of experience leading cybersecurity governance and operations in financial services, supported by staff cybersecurity specialists. Management provides cybersecurity statistics and details to the Board quarterly.


text: Board Committee Oversight The Company's Board Enterprise Risk Committee provides oversight of the cyber program. The Committee consists of Board members, chaired by an independent director. Committee members have extensive experience in various disciplines including risk management, communications, litigation, banking and transactional matters, and regulatory compliance. The Board Committee receives regular reports informing on the effectiveness of the overall cybersecurity program and the detection, response, and recovery from significant cyber incidents. Cybersecurity metrics are reported quarterly to the Committee and Key Risk Indicators are reported.


text: We have developed and implemented a cybersecurity framework intended to assess, identify, and manage risks from threats to the security of our information, systems, products, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, NIST 800-53 and International Organization for Standardization 27001 ("ISO 27001") Framework, although this does not imply that we meet all technical standards, specifications, or requirements under the NIST or ISO 27001.

companyName: SONIDA SENIOR LIVING, INC.

ticker: SNDA


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer information, personal information, intellectual property and proprietary information. • Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have a strategic partner (a Managed Security Service Provider ("MSSP")) that is responsible for leading the initial assessment of priority and severity. Our cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise level. • Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at the Company. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations, and industry risks. • Supplier risk assessments: We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for us to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Third-party assessments of the Company: We have engaged third-party cybersecurity companies to periodically assess our cybersecurity posture and to assist in identifying and remediating risks from cybersecurity threats.


text: We also consider cybersecurity, along with other risks to us, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition.


text: The Audit Committee of our Board of Directors is responsible for board-level oversight of risks from cybersecurity threats, and the Audit Committee reports back to the full Board of Directors about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about the Company's practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates, from our Chief Technology Officer.


text: Our Chief Technology Officer reports to our Chief Executive Officer and leads the Company's overall cybersecurity function, including the assessment and management of cybersecurity risks. The Chief Technology Officer has over 25 years of experience in managing and leading information technology or cybersecurity teams and participates in various cybersecurity organizations. The Chief Technology Officer collaborates with operation vice presidents and department vice presidents to identify and analyze cybersecurity risks to us; considers industry trends; implements controls, as appropriate and feasible, to mitigate these risks; and enables business leaders to make risk-based business decisions that implicate cybersecurity considerations. The Chief Technology Officer meets with senior leadership to review and discuss our cybersecurity program, including emerging cyber risks, threats, and industry trends. The Chief Technology Officer also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with external security personnel and internal business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to inform our cybersecurity technologies and processes.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: P3 Health Partners Inc.

ticker: PIII


text: We design and assess our program based on the HITRUST Common Security Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the HITRUST Common Security Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the section titled "Risk Factors—Risks Related to Our Business and Industry—Our business and operations would suffer in the event of information technology system failures, security breaches, cyberattacks or other deficiencies in cybersecurity."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President of Technology and Director of Information Systems Security or other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including, but not limited to, our Senior Vice President of Technology, Director of Information Systems Security, and Director of Information Systems Governance Risk and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience spans over 20 years in all aspects of information technology including cybersecurity, IT operations (infrastructure engineering and architecture design), and IT governance audit compliance across industries such as energy, healthcare, pharmaceuticals, and finance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have implemented and maintain a cybersecurity program (the "Cybersecurity Program") that includes various processes designed to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program processes utilize a risk-based approach including a cybersecurity incident response plan.

companyName: Shapeways Holdings, Inc.


text: We work with a third-party vendor, which has extensive cybersecurity expertise to help protect and defend our networks, physical systems, infrastructure, and data from cybersecurity threats. This vendor has advised us on material cybersecurity-related risks and helped us establish controls designed to protect, detect, respond to, and recover from cybersecurity incidents. These controls include a firewall protection that is implemented in all three of our facilities, antivirus software protection, two-factor authentication enforced on all endpoints including Windows PCs and laptops, and intrusion prevention software designed to automatically block any unauthorized access attempts on our servers. Our cybersecurity controls are embedded within our overall risk management processes and technology, including a 24/7 threat monitoring system provided by the vendor. We are in the process of developing and implementing procedures to oversee or identify material risks from cyber threats associated with use of third party service providers.


text: The audit committee of our board of directors is responsible for oversight of the Company's cybersecurity and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to data breaches. The audit committee receives quarterly updates on our Cybersecurity Program from our Chief Technology Officer ("CTO") at its regularly-scheduled committee meetings or more frequently as needed. The chair of the audit committee then briefs the full board of directors on matters covered at the audit committee meeting, including cybersecurity matters.


text: Our Cybersecurity and Information Technology team is led by our CTO, who is responsible for cybersecurity risk management. Our CTO has held multiple leadership positions in the information technology ("IT") industry with responsibilities for and influence over cybersecurity implementation delivery.


text: Our CTO executes the Cybersecurity Program and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents, with the support of the IT team and our third-party cybersecurity vendor. Our cybersecurity incident response framework is governed by our cybersecurity incident response plan, which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. We have an incident response team whose primary responsibilities include: • Evaluating and validating the impact of an incident; • Approving and implementing certain incident response countermeasures and remediation actions; and • Escalating incidents and response countermeasures for approval;


text: As of the date of this Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: We believe that our cybersecurity program provides effective protection of client information and of our operating systems from known and reasonably expected risks, while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we maintain up-to-date information security and monitoring controls, which we believe mitigates cybersecurity risks and threats while optimizing the utility of our systems. At the same time, cyberattacks are increasingly common, sophisticated and destructive, and several large, highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. These events also have carried significant reputational risk for the successfully targeted institutions. In order to mitigate these risks, our Information Security Officer ("ISO") is responsible for our cybersecurity programs and for the detection of and response to any identified threats and incidents. That individual also reports regularly to our Board of Directors, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. Although the SEC's new cybersecurity reporting requirements do not require us to file a Form 8-K announcing the occurrence of material cybersecurity incidents, that obligation will apply to the Company with respect to material incidents discovered after June 15, 2024, and we are adapting our disclosure procedures to assure the timely compliance with the Company's obligations under Item 1.05 of Form 8-K once that requirement becomes applicable to the Company. In the meantime, we continue to evaluate and monitor cybersecurity risks to assess whether any detected incident would be material to investors and, in such an event, we would make a timely report of a material incident under Item 7.01 or Item 8.01 of Form 8-K.

companyName: OP Bancorp

ticker: OPBK


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our procedures and security program are the guiding policies over our cybersecurity risk management. Additionally, our IT team uses the best currently available tools to help protect against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our employees are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.


text: Engaging Third Parties for Risk Management We recognize the complexity and evolving nature of cybersecurity threats, which is why we engage a range of external experts, including cybersecurity consultants, in evaluating and testing our risk management systems. Our IT security team partners with third-parties to perform annual penetration testing, vulnerability scanning, and monitoring of any potentially suspicious activity across the Company.


text: Oversight of Third-party Risk We also maintain a third party risk management program that applies to all third-party vendor relationships. Our Board of Directors has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to regarding strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews this policy on at least an annual basis to assure that we implement procedures and practices have been established by management. Our chief risk officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Company's strategic goals, risk appetite and the level of risk and complexity of its third-party relationships. This individual regularly reports to the Board of Directors regarding third-party risk management activities. The Company's internal audit staff also determines the frequency and scope of audits to examine the effectiveness of our third party risk management program.


text: The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management. As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity risks or threats that have materially impaired our business strategy, results of operations, or financial condition.


text: The Board recognizes the importance of managing risks associated with cybersecurity threats. The Board has established robust oversight procedures to promote effective governance in managing cybersecurity risks because of the significance of these threats to our operational integrity and shareholder confidence.


text: The Board Risk and Compliance Committee ("BRCC") is central to the Board's oversight of cybersecurity risks. The BRCC currently oversees various risk areas such as regulatory compliance, CRA, BSA/AMLA, enterprise risk management, cybersecurity, technology, and third-party risk management. The committee ensures that the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The BRCC reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include risk assessments of cybersecurity and related risks, as well as the company's vulnerability to those risks. The BRCC reviews an annual evaluation of the company's cybersecurity posture and the effectiveness of its risk management strategies, identifying areas for improvement and ensuring the cybersecurity efforts are integrated with the overall risk management framework.


text: The ISO plays a pivotal role in informing the BRCC on cybersecurity risks. Jointly with the Chief Risk Officer, the ISO reports quarterly to the BRCC on a range of topics, including: • Current cybersecurity landscape and risks; • Status of ongoing cybersecurity incidents, threats and strategies; • Internal and external test result and remediation efforts; • Enforcement of ongoing awareness training on information security; • Cybersecurity incident reporting and post-incident reviews; and • Compliance with regulatory requirements and evolving industry trends.


text: The ISO reports to the BRCC on the status and impact of any information security related developments and strategic initiatives, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the BRCC, the ISO, Chief Risk Officer, Chief Information Officer, and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Company's Management Risk and Compliance Committee also reports directly to the BRCC regarding our risk management initiatives. The BRCC also receives quarterly reports from the Executive IT Committee and IT department in order to say informed on all aspects of cybersecurity risk affecting the Company.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the ISO, who has extensive cybersecurity program management experience working in various information security roles, including teaching as an information security instructor at a University. The ISO holds various information security qualifications, such as a doctoral degree in information technology and cyber security and holds the Certified Information Systems Security Professional ("CISSP") certification. The ISO and Chief Risk Officer are responsible for managing the disclosure and communications related to cybersecurity incidents. Our Chief Risk Officer chairs the Management Compliance and Risk Committee independently and has more than 20 years of experience in compliance and risk management.


text: Monitoring Cybersecurity Incidents The company utilizes various industry-leading systems to provide 24/7 threat detection and response capability, many of which provide proactive measures to shut threats down before they can harm the organization. Additionally, the company's incident response team periodically performs proactive measures, searching for potential indicators of threats, compromise, and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The ISO is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat is immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The ISO may determine that an incident has the potential to be materially relevant and would escalate that determination to the executive management, including Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, and other leaders and advisors of the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.


text: Reporting to Board of Directors The ISO, in his capacity as such, regularly reports to management and the BRCC on all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face. In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.


text: Avalo's management and Board of Directors recognize the importance of information security and managing cybersecurity risks across the enterprise. We have strategically designed our robust Information Security Program (the "Program") to assess, identify, and manage these cybersecurity risks, protect the Company from such risks, and respond to, and recover from, cybersecurity incidents.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: The Company's Information Security Working Group ("ISWG") is actively engaged in managing cybersecurity risks and overseeing the design, implementation, and evaluation of the Program. The purpose of the ISWG is to define cybersecurity risk tolerance, guide implementation of the Program, monitor Program development and effectiveness, and validate investments in cybersecurity measures and infrastructure. Members of the ISWG include: the Chief Financial Officer, the head of the Company's Human Resource department, the Senior Vice President of Program Management, Corporate Infrastructure, and Clinical Operations, the Senior Vice President of Regulatory and Quality Assurance, and the Company's head of Information Technology. The group meets quarterly to review the effectiveness of the Program, discuss any new developments and potential improvements to the Program, and evaluate internal and external security-related events to determine how Avalo can take appropriate steps to mitigate such risks.


text: The Audit Committee (the "Committee") is primarily responsible for oversight of the Program. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. Yingping Zhang serves as our Vice President of Information Technology, and she also helps oversee the implementation and effectiveness of the Program as a member of the ISWG. Ms. Zhang graduated from the University of Pittsburgh with a Master of Science in Electrical Engineering and has over thirty years of experience as an information technology professional. Prior to Avalo, Ms. Zhang worked as an Executive Consultant for Insightful Group, the Vice President of Information Technology at Horizon, and the Vice President of Informational Technology and Information Services at Viela Bio, among other positions within biopharma companies. Ms. Zhang reports to Lisa Hegg, Senior Vice President, Program Management, Corporate Infrastructure, and Clinical Operations. Ms. Hegg provides information technology and cybersecurity reports a necessary at meetings of management's Disclosure Committee, which is communicated quarterly to the Audit Committee, with greater frequency as necessary. Ms. Zhang regularly informs Ms. Hegg, our Chief Executive Officer (CEO) and other members of the leadership team, about the Program, best practices, current cybersecurity threats, the risk landscape, and mitigation strategies. These reports include the following on an as-needed basis: updates on the Program; assessment of the Program; emerging risks or concerns; policies, procedures, and training; and risk mitigation strategies.


text: The underlying controls of our Program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Ms. Zhang is responsible for developing enterprise-wide cybersecurity strategy, architecture, policies, processes, and controls, and is directly responsible for our cybersecurity program.


text: We use various tools and methodologies to identify, manage, and test for cybersecurity risk on a regular cadence both at the enterprise level and using third-party service providers. These third parties include cybersecurity managed security service providers (MSSPs), consultants, advisors, and auditors, who we engage to evaluate our controls, whether through penetration testing, independent audits, or consulting on best practices to address new threats or challenges. To ensure we use reputable vendors for our information systems, we review and confirm SOC 1 reports for vendors providing critical business services. For vendors handling Avalo's clinical and manufacturing information, we employ quality agreements and vendor audits to ensure vendor compliance with our Program and all applicable regulatory requirements. We also engaged internal auditors to conduct a walkthrough of our information technology control environment, test our information technology controls, and report to us any findings. External security service firms monitor the Company's networks at all times, and Company laptops are patched weekly with up-to-date antivirus and real time threat-monitoring protection. Further, we actively engage with key vendors, industry participants, and law enforcement officials as part of our continuing efforts to evaluate and improve our Program.


text: Our regular interactions with third-party vendors and suppliers pose a cybersecurity risk that could adversely impact our business or employees. We conduct information security assessments before onboarding and upon detection of an increase in risk profile. In addition, we require providers to meet appropriate security requirements, controls and responsibilities and include additional security and privacy addenda to our contracts where applicable.


text: Internally, our employees are a key part of our Program. All Avalo employees and contractors are required to participate in annual security awareness training, which includes phishing simulations. Company Employees are also trained on policies of information security and acceptable usage of systems, as well as procedures related to electronic record management, and Avalo regularly reviews and updates user accounts and permissions and ensures that only approved applications are installed on Company devices. The Company manages endpoints centrally and content can be deleted remotely in the event of stolen devices or terminated users.


text: To date, Avalo has not identified any cyber event or risks from cybersecurity threats that could be considered material, individually or in the aggregate. Notwithstanding our vigilance and our Program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology.


text: We have implemented and maintain various processes to identify, assess, prioritize, manage, and report on cybersecurity risks that could result in loss or other adverse consequences to Pure Storage. We maintain a variety of channels designed to identify risks, including risks associated with our use of third-party service providers, such as by conducting vulnerability assessments, reviewing audit findings, discussing with key stakeholders, and analyzing security incidents and reports from our employees and others.

companyName: Everpure, Inc.

ticker: PSTG


text: We maintain procedures and processes designed to evaluate and respond to certain identified risks. We assess potential adverse impact across a variety of factors, such as financial, product roadmap, brand and reputation, operational performance, and our ability to comply with applicable laws and regulations. Potential responses for cybersecurity risks are: • Avoiding activities or situations that could lead to harm. • Engaging in preventative measures, safety protocols, and security enhancements. • Allocating risk through contract or insurance. • Developing contingency plans to address potential negative outcomes associated with cybersecurity risks if they occur.


text: Our cybersecurity program is integrated into our broader enterprise risk management framework. For example, certain members of our executive management evaluate material risks from cybersecurity threats against our overall business objectives and report to our Audit and Risk Committee (Audit Committee) of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats. These service providers provide services such as threat intelligence and dark web monitoring. In addition, we engage independent third parties (such as assessors or consultants) to periodically assess the capability and maturity of our cybersecurity program.


text: Our Governance, Risk, and Compliance (GRC) team oversees our third-party cybersecurity risk management program, which evaluates the security posture of certain third-party vendors. Our assessments may include the collection and verification of various cybersecurity measures implemented by our third-party vendors. Depending upon the third-party vendor as well as the data and information systems to which the vendor will have access, the GRC team may review the vendor's information security policies and standards, examine the vendor's certifications and attestations, and review vulnerability assessments or other evaluations.


text: For a description of the risks from cybersecurity threats that may materially affect our company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled "If our security measures, or those maintained on our behalf, are compromised, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, products, communications or data is compromised, limited, or fails, our business could experience a material adverse impact, including without limitation, a material interruption to our operations, harm to our reputation, a loss of customers, significant fines, penalties and liabilities, or breach or triggering of data protection laws, privacy policies or other obligations."


text: Our Board of Directors addresses the company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for overseeing the company's cybersecurity risk management program, including mitigation of risks from cybersecurity threats. In addition, we have established an Executive Security Council (ESC). The ESC oversees and governs our cybersecurity program.


text: Our cybersecurity program is implemented and maintained by the Pure Security Office (PSO), a team of security professionals responsible for developing and implementing an information security program designed to protect our assets, including data, networks, applications and people, from cyber threats. The PSO includes individuals with expertise in the following areas and who continue to leverage such expertise at the company in the following manners: • Governance, Risk & Compliance (GRC). Maintaining cybersecurity policies, standards, and processes in place and providing training to our employees on them. • Security Operations. Monitoring our critical systems and assets, and that we are able to identify and respond to security incidents in a timely manner. • Security Engineering & Architecture. Implementing risk-based security controls. • Product Security. Supporting our product teams' security objectives by providing design review, certification management, penetration testing, and consulting services, as well as operating security vulnerability management and reporting dashboard capabilities. • Enterprise resiliency. Developing policies, procedures and practices for critical operations recovery and business continuity in the event of a cybersecurity incident.


text: The PSO reports to our Audit Committee and ESC on cybersecurity risks. Our Chief Information Security Officer (CISO) meets with the ESC and Audit Committee periodically in an effort to review the company's cybersecurity risks, the company's prevention, detection and remediation efforts of cybersecurity incidents (as appropriate), and key cybersecurity performance indicators. We also maintain procedures designed to escalate certain cybersecurity risks and incidents to members of executive management and the board of directors, as appropriate.


text: We have established procedures for evaluating, recognizing, and handling significant risks stemming from potential unauthorized events occurring on or through our electronic information systems, which could negatively impact the confidentiality, integrity, or accessibility of our information systems or the data stored within them. These procedures encompass a diverse range of mechanisms, controls, technologies, systems, and other processes aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. This data comprises confidential, business, and personal information that we gather, process, store, and transmit as part of our operations, including on behalf of third parties. Furthermore, we utilize systems and procedures intended to minimize the repercussions of a security incident involving a third-party vendor or customer. Additionally, we employ procedures to supervise and identify significant risks arising from cybersecurity threats linked to our utilization of third-party technology and systems, such as encryption and authentication systems, employee email services, back-office support systems, and other operational functions.

companyName: Intellicheck, Inc.

ticker: IDN


text: We adhere to a risk management framework based on applicable laws and regulations, incorporating industry standards and recognized practices to handle cybersecurity risks across our products, services, infrastructure and corporate assets. To evaluate and address cybersecurity threats, we analyze factors such as threat intelligence, first- and third-party vulnerabilities, changing regulatory requirements and observed incidents. We regularly conduct risk assessments to gauge the effectiveness and maturity of our systems, identifying areas for improvement. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. We also maintain a privacy risk management program to assess risks related to user data collection, with an independent third-party privacy assessor to ensure compliance. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions, alongside annual cybersecurity and privacy training for all staff members.


text: Our cybersecurity risks and associated mitigations are evaluated by our IT team, including our VP of Technology Operations and Information Security, as part of our enterprise risk assessments that are reviewed by our management team. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, which include: internal briefings from relevant personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity consultants; and alerts and reports produced by security tools deployed in our IT environment. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: The Company recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data we produce and collect. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from external experts. Our executive leadership team is responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: SpringBig Holdings, Inc.

ticker: SBIG


text: We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent public accounting firm of matters and any relevant developments.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: We recognize the need to maintain the security and confidentiality of personal information, protected health information and other confidential data that we may collect or use in connection with our business, and the importance of assessing, identifying and managing various cybersecurity risks that may impact our business. Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of hardware, software and technical applications and platforms developed or provided by our third-party service providers, and facilitates coordination across different departments of our company.

companyName: Acutus Medical, Inc.


text: As part of our enterprise risk management process, we assess the various cybersecurity risks that may impact our business and implement plans and initiatives that are intended to mitigate those risks.


text: Our cybersecurity program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, software, and services; (ii) a cybersecurity team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally; (iv) new-hire and annual cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security. Our cybersecurity team is responsible for assessing our cybersecurity risk management program and we also engage a third party for such assessment.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the board of directors (the "Audit Committee"). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Director of IT who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our dedicated personnel are knowledgeable about our products and systems and experienced information systems security professionals and information security managers with many years of experience. Management regularly updates the Audit Committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Related to Our Business and the Products—Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in this annual report on Form 10-K.


text: Cybersecurity risk management is an important part of the Company's overall enterprise risk management systems and processes. Canoo utilizes industry standard cybersecurity frameworks including NIST CSF and ISO 27001 as part of our overall cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the frameworks as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Canoo Inc.

ticker: GOEVQ


text: Led by the Cybersecurity team with oversight by the Audit Committee of the Board and executive management, the program incorporates teams across the organization including Information Technology, Compliance, Legal and Product.


text: The program utilizes risk assessments for the identification of material cybersecurity risks to critical systems, information, products, personnel, facilities, and technology environments.


text: We operate cybersecurity threat intelligence and monitoring programs that utilize third-party tools and services, commercial and open-source threat intelligence, and cybersecurity communities like the Automotive ISAC to identify and assess threats. Security events are evaluated and prioritized for response and remediation.


text: We encourage proactive vulnerability reporting through our vulnerability disclosure program, maintain appropriate incident response plans and procedures, and operate incident response teams capable of responding to cybersecurity incidents.


text: We conduct regular internal workforce training and awareness programs, perform internal testing and assessments of controls where appropriate, and periodically engage external service providers and consultants to conduct assessments, evaluations, and penetration testing activities.


text: Third-party risk management processes exist to minimize the material cybersecurity risks associated with our use of third-party suppliers, vendors and service providers. Cybersecurity risks, cyber risk ratings, cybersecurity program maturity and potential fourth-party risks are typically considered when selecting and performing oversight of third-party service providers. While we are in the process of increasing the resiliency of these processes across the board, our control over and ability to monitor the security posture of third-party vendors and service providers remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: The Audit Committee of the Board is responsible for oversight of cybersecurity risks. The Audit Committee and Board periodically and as necessary receive updates from the Cybersecurity team or external experts regarding the activities and performance of the cybersecurity risk management program, current and potential risks and threats, and other relevant cybersecurity topics.


text: We recognize that cybersecurity risk is a critical enterprise concern. To mitigate cybersecurity risk, we have obtained cybersecurity insurance coverage and established a Cybersecurity and IT Governance Program to stay at the forefront of security and threat management. Our program monitors and assesses our IT environment to provide continuous improvement and automate incident response. We have instituted best practices for preventive safeguards, governance, monitoring, detection, response and third-party validation. Data, updates and results from our program are provided to the Audit Committee at regularly scheduled meetings.

companyName: Cano Health, Inc.


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity policies, standards, processes and practices. To protect the Company's information systems from cybersecurity threats, the Company uses various security tools that help the Company identify, escalate, investigate, resolve and recover from security incidents in a timely manner. These efforts include, but not limited to, managed detection and response, security information and event management, vulnerability management, email security filtering, threat intelligence, security awareness program, endpoint detection and response, security automation and orchestration, and intrusion detection and prevention systems.


text: The Company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes, including periodic penetration tests, annual compliance risk assessments, and third-party cybersecurity assessments. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Data security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Company's Audit Committee oversees our risk management program, which is designed to identify, evaluate, and respond to our high-priority risks and opportunities to mitigate those risks. The Company's management, including our executive officers, reports to the Audit Committee on areas of material risk based on its annual risk assessment exercise and management is primarily responsible for managing the risks associated with the Company's operation and business, including cybersecurity and other information security risks. As part of the annual risk assessment exercise, our management conducts executive management interviews, participates in key committee meetings (including meetings of the Disclosure Committee, Compliance Committee and, during our ERP implementation, the Oracle Committee), quantitatively and qualitatively scopes financial accounts and IT system sources and considers industry reports and legal and/or regulatory changes to understand short-term, medium-term and long-term priorities, objectives and strategies, taking into account the level of maturity and degree of integration of governance and risk management programs. Management provides regular updates to the Audit Committee on our risk management program and reports on identified high-priority risks and opportunities during regularly scheduled Audit Committee meetings. In turn, the Audit Committee Chairman is responsible for regularly reporting to the Board.


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, management oversees cybersecurity assessments to identify potential threats, vulnerabilities, and the potential impact on the business. Management is responsible for establishing cybersecurity policies and procedures that align with industry best practices and regulatory requirements. Management oversees the implementation of systems that continuously monitor the Company's cybersecurity posture and drives a culture of continuous improvement in cybersecurity.


text: In February 2024, the Company formed a dedicated Cybersecurity Risk Committee (the "Cybersecurity Committee"), consisting of designated members of the Company's Information Technology team, the Company's General Counsel and Chief Compliance Officer, the Company's Deputy General Counsel, the Company's Controller, the Company's Chief Operating Officer, and designated members of the Company's Communications team. The Company's CEO and CFO have the authority to appoint and remove members of the Cybersecurity Committee.


text: The Cybersecurity Committee is responsible for, among other things: • Reviewing management's implementation of cybersecurity programs, privacy programs and related risk policies and procedures and management's actions to (a) safeguard the effectiveness of such programs and policies and the integrity of the Company's electronic systems and facilities and (b) prevent, detect and respond to cyber-attacks or information or data breaches involving the Company's electronic information, intellectual property and data; • Reviewing information from the Company's IT Department regarding matters related to the management of cybersecurity risks and privacy risks; • Reviewing management's cybersecurity and privacy crisis preparedness and incident response plans (including policies and procedures regarding public disclosure of any such incidents) and the Company's disaster recovery capabilities; • In the event of an identified breach or attempted breach, the details and impact of any such breach or attempted breach of the Company's information technology systems, networks and/or the types of information, data, and assets collected, created, used, processed, and/or maintained by or on behalf of the Company, including personal information and/or any information or assets of the Company's customers, consumers, employees and business partners, the appropriately investigating any such events, the response to such events, and the implementation of measures to help prevent the recurrence of such events and review summaries of any incidents or activities that are required to be reported to the Audit Committee pursuant to any escalation policies applicable to such cybersecurity incident; • Reviewing the effectiveness of the Company's cybersecurity and privacy risk management programs and its practices for identifying, managing and mitigating cybersecurity and privacy risks across all business functions and recommending improvements, where appropriate; • Reviewing the Company's framework for adopting policies and procedures establishing cybersecurity and privacy risk-management governance, cybersecurity and privacy risk-management procedures, and cybersecurity and privacy risk control infrastructure; • Reviewing the Company's processes and systems for implementing and monitoring compliance with cybersecurity and privacy risk-management and cybersecurity and privacy risk-control policies and procedures, including:


text: Processes and systems for identifying and reporting cybersecurity and privacy risks (including emerging cybersecurity and privacy risks) and cybersecurity and privacy risk management deficiencies, and implementation of actions to address these deficiencies; and Processes and systems to integrate cybersecurity and privacy risk management and associated controls with management goals;


text: • Reviewing significant investments and expenditures the Company proposes to make to manage or mitigate enterprise risks and make recommendations, where appropriate; • Reviewing reports and presentations from management and the Company's advisors, including outside cybersecurity and privacy experts, regarding the management of cybersecurity and privacy risk programs; • Reviewing and addressing, as appropriate, management's corrective actions for deficiencies that arise with respect to the effectiveness of the Company's cybersecurity and privacy risk management programs; • Reviewing and discussing with management the Company's public disclosures in its SEC reports relating to the Company's cybersecurity and privacy matters, including privacy, network security and data security, including reviewing applicable cybersecurity and privacy disclosures in the "Risk Factors" section of this 2023 Form 10-K; • Reviewing the adequacy of the Company's cybersecurity insurance programs to determine if the coverages are sufficient, consistent with market conditions, to protect the Company; • Reviewing, with the Company's General Counsel or their designee, any cybersecurity and/or privacy-related legal matter that could have a significant impact on the Company's business or reputation; and • Addressing other matters as the Cybersecurity Committee Chair or other members of the Cybersecurity Committee determine relevant to the Cybersecurity Committee's oversight of cybersecurity and privacy risk assessment and management.


text: The Cybersecurity Committee will provide periodic updates to the Company's Audit Committee regarding its activities, and in the event of a material cybersecurity or privacy incident involving the Company, on the status of the Company's cybersecurity and data protection response and disclosures. Through these briefings, the Cybersecurity Committee will periodically provide the Audit Committee with appropriate information, as applicable, on the status of--(1) the Company's cybersecurity and data protection program strategies, projects, initiatives, opportunities, developments and any material changes in the foregoing; (2) budgets and resources; (3) information security or privacy assessments, audits and tests conducted by the Company or third parties; (4) the Company's escalation protocols with respect to prompt reporting of cybersecurity incidents to management, the Audit Committee and the Board; and (5) material cybersecurity and privacy incidents, risks, issues and legal developments, as well as the remediation or risk mitigation measures undertaken to address such issues. Also, any cybersecurity incident requiring public disclosure on a Current Report on Form 8-K or other applicable public filings or disclosures will be reported to the Audit Committee prior to any such disclosure. As appropriate, the briefings also will present management's recommendations for changes to the Company's cybersecurity and data protection practices.


text: UnitedHealth Group Incorporated ("UHG") recently widely-announced that they had experienced a cybersecurity incident in which a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare (owned by UHG) information technology systems. Through filings on Form 8-K, press releases and conference calls, UHG is providing regular updates on its assessment of this cybersecurity incident, including, without limitation, its remediation and service restoration activities. The Company's Cybersecurity Committee and its respective members are monitoring UHG's cybersecurity incident for any potential impact it may have on the Company and its various constituencies.


text: Cybersecurity is a critical aspect of our operations, and our board of directors and management prioritize safeguarding our digital assets and ensuring the integrity and confidentiality of sensitive information to protect our assets, customers, and stakeholders. Our cybersecurity program is managed by our Global IT Director and overseen by our executive leadership team and board of directors. It encompasses risk management, a management framework, governance, education and training across the organization, SOC2 compliance, and an incident response protocol.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: We employ a proactive risk management strategy to identify, assess, track, and mitigate cyber security risks. Our risk assessment process involves continuous monitoring of our IT infrastructure, external vulnerability assessments, and reviews of our third-party relationships. We prioritize risks based on their potential impact on our operations and implement targeted controls and safeguards to mitigate identified threats.


text: Our Cybersecurity management framework is aligned with the Cybersecurity Framework (CSF) developed by the National Institute of Standards and Technology (NIST) and COBIT 2019. This framework provides a structured approach to managing our policies, standards, and processes, improving our cyber security posture. Additionally, we maintain SOC2 compliance, demonstrating our adherence to industry-recognized security standards and best practices.


text: Our board of directors and our executive leadership team, through our Information Security Executive Charter, oversee our risk management program, of which cybersecurity represents an important component. Our Global IT Director is responsible for managing our risk management program, including our cybersecurity strategies and initiatives and the periodic review of our policies, standards, and risks. Our Global IT Director has over 25 years of experience in technology and security. Our executive leadership approves cyber security strategies, initiatives, and investments to ensure alignment with business objectives and risk tolerance.


text: In the event of a cyber security incident, we would follow an incident response protocol that includes procedures for incident tracking, escalation, containment, eradication, and recovery. As part of our incident response process, we would adhere to SEC reporting requirements related to cyber security incidents, providing timely and transparent disclosures as necessary.


text: Cybersecurity threats, and their evolving nature, pose a risk to us and our strategy, results of operations, and financial condition in the future. Our risk factors include further detail about the cybersecurity risks we face. To date, cybersecurity threats or incidents have not materially affected us or our operations. Our focus on risk management, governance, compliance, and incident response is intended to mitigate the potential harm posed by evolving cyber threats and challenges.


text: We rely extensively on various information systems, operated by us as well as third-party service providers, to manage many aspects of our business. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action.

companyName: Torrid Holdings Inc.

ticker: CURV


text: Accordingly, we recognize the critical importance of maintaining the safety and security of these information systems and have implemented multiple layers of cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risk. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Efforts to assess, identify, and manage cybersecurity risk are led by our dedicated Chief Technology Officer ("CTO"), and supported by an experienced team, other members of management, and the Board. From time to time, we engage consultants, auditors, and other third parties to assist us in these efforts.


text: We assess our information security program using an industry-leading cybersecurity framework, the Center for Internet Security Critical Security Controls. A risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on us and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: To test our cybersecurity program, we perform periodic vulnerability testing, engage an independent third party to perform periodic internal and external penetration testing, and engage other third parties to conduct periodic assessments of our cybersecurity capabilities. We continuously expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments and external monitoring sources, including performing dark web analyses, to better inform us during contracting and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place that are designed to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups, including the legal and finance functions, the Board, and external breach counsel, and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans for certain critical applications and services to prepare for and respond to the potential for a disruption in the technology we rely on.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Torrid (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems. See "Risks Related to Our Business" in Item 1A, "Risk Factors" in this Annual Report for a discussion of cybersecurity risks that may materially impact us.


text: Based on the information available as of the date of this Annual Report, no material risks from known cybersecurity incidents have, either individually or in the aggregate, materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. There is no guarantee that any risks from cybersecurity threats will not materially affect us in the future.


text: The Board oversees our overall risk assessment process, where we assess key enterprise risks within the company, and at least quarterly, senior management reviews these risks with the Board. Cybersecurity and other technology risks, which are considered in our enterprise risk management framework, continue to remain a top priority for the Board. Primary oversight responsibility for cybersecurity and other technology risks has been given to the Audit Committee by the Board.


text: Our cybersecurity risk management and strategy processes are led by our CTO, assisted by our Vice President of Infrastructure and Operations. Together, they have over 20 years of combined professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and managing multiple industry and regulatory compliance environments.


text: At least quarterly, the Audit Committee, Chief Executive Officer and senior finance and legal management, evaluate, review and discuss with the CTO our cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, recent cybersecurity incidents at other companies and the emerging threat landscape. Significant cybersecurity incidents are reviewed and discussed with the Audit Committee and senior finance and legal management as required by our cybersecurity incident response plan.


text: The Company has developed and implemented a cybersecurity program (the "Program") designed to identify, assess, and mitigate material cybersecurity related risks. The Company's program leverages recognized frameworks and standards, including National Institute of Standards and Technology Cyber Security Framework, the Center for Internet Security Critical Security Controls, and the Payment Card Industry Data Security Standards, to assess, organize, and improve our program. As part of the Program, the Company maintains various safeguards to help protect the confidentiality, integrity, and availability of its information systems and data, including: • layered technical controls designed to help detect, prevent, and mitigate cybersecurity threats to Company assets; • utilization of a third-party managed detection and response service provider to monitor for cybersecurity threats, ingest threat-intelligence, and coordinate incident response efforts; • policies, procedures, and standards that are utilized to outline the Company's expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity training and education for our employees; • practices for monitoring cybersecurity risks of key third-party service providers; and • incident response plans that provide a framework for the Company's response to cybersecurity incidents.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: From time to time, the Company engages third-party subject matter experts and consultants to conduct evaluations of our program and security controls, whether through penetration testing, assessments, or consulting on best practices to address new challenges. Results are used to identify and assess risks as well as drive priorities and initiatives to improve the overall Program. The Company also engages third-party experts and consultants, when deemed appropriate, to assist with responding to cybersecurity incidents, such as external legal counsel and forensic specialists.


text: In addition, assessing, identifying, and managing cybersecurity-related risks are integrated into our overall enterprise risk management ("ERM") process. Cybersecurity risks are included in the risk universe that the ERM function evaluates, with input from information security subject matter experts at the Company, to assess top risks to the enterprise. The ERM process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. By integrating cybersecurity risk into the overall ERM process in this manner, the Company is better equipped to identify, assess, and manage material cybersecurity risks.


text: During the period of this Annual Report, the business strategy, results of operations and financial condition of the Company have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Risks Related to Information Technology and Cybersecurity at Item 1A Risk Factors.


text: The Company's Information Systems organization, which is led by the Chief Information Officer ("CIO"), is responsible for implementing and maintaining the Company's Program and related risk management. The Company's current CIO has formal education in information technology and extensive work experience gained from over 20 years in various technology leadership roles. As leader of the Company's information systems and technology function, the CIO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation. The team responsible for developing and executing its cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or significant experience working in information technology and cybersecurity, including relevant industry experience in security related industries.