text: The Audit Committee (the "Committee") is primarily responsible for oversight of the Program. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. Yingping Zhang serves as our Vice President of Information Technology, and she also helps oversee the implementation and effectiveness of the Program as a member of the ISWG. Ms. Zhang graduated from the University of Pittsburgh with a Master of Science in Electrical Engineering and has over thirty years of experience as an information technology professional. Prior to Avalo, Ms. Zhang worked as an Executive Consultant for Insightful Group, the Vice President of Information Technology at Horizon, and the Vice President of Informational Technology and Information Services at Viela Bio, among other positions within biopharma companies. Ms. Zhang reports to Lisa Hegg, Senior Vice President of Program Management and Corporate Infrastructure. Ms. Hegg provides information technology and cybersecurity reports as necessary at meetings of management's Disclosure Committee, which is communicated quarterly to the Audit Committee, with greater frequency as necessary. Ms. Zhang regularly informs Ms. Hegg, our Chief Executive Officer (CEO) and other members of the leadership team, about the Program, best practices, current cybersecurity threats, the risk landscape, and mitigation strategies. These reports include the following on an as-needed basis: updates on the Program; assessment of the Program; emerging risks or concerns; policies, procedures, and training; and risk mitigation strategies.


text: The underlying controls of our Program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Ms. Zhang is responsible for developing enterprise-wide cybersecurity strategy, architecture, policies, processes, and controls, and is directly responsible for our cybersecurity program.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX

secItem: Item 1C


text: We use various tools and methodologies to identify, manage, and test for cybersecurity risk on a regular cadence both at the enterprise level and using third-party service providers. These third parties include cybersecurity managed security service providers (MSSPs), consultants, advisors, and auditors, who we engage to evaluate our controls, whether through penetration testing, independent audits, or consulting on best practices to address new threats or challenges. To ensure we use reputable vendors for our information systems, we review and confirm SOC 1 reports for vendors providing critical business services. For vendors handling Avalo's clinical and manufacturing information, we employ quality agreements and vendor audits to ensure vendor compliance with our Program and all applicable regulatory requirements. We also engaged internal auditors to conduct a walkthrough of our information technology control environment, test our information technology controls, and report to us any findings. External security service firms monitor the Company's networks at all times, and Company laptops are patched weekly with up-to-date antivirus and real time threat-monitoring protection. Further, we actively engage with key vendors, industry participants, and law enforcement officials as part of our continuing efforts to evaluate and improve our Program.


text: Our regular interactions with third-party vendors and suppliers pose a cybersecurity risk that could adversely impact our business or employees. We conduct information security assessments before onboarding and upon detection of an increase in risk profile. In addition, we require providers to meet appropriate security requirements, controls and responsibilities and include additional security and privacy addenda to our contracts where applicable.


text: Internally, our employees are a key part of our Program. All Avalo employees and contractors are required to participate in annual security awareness training, which includes phishing simulations. Company Employees are also trained on policies of information security and acceptable usage of systems, as well as procedures related to electronic record management, and Avalo regularly reviews and updates user accounts and permissions and ensures that only approved applications are installed on Company devices. The Company manages endpoints centrally and content can be deleted remotely in the event of stolen devices or terminated users.


text: To date, Avalo has not identified any cyber event or risks from cybersecurity threats that could be considered material, individually or in the aggregate. Notwithstanding our vigilance and our Program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology.


text: Cyber Risk Management and Strategy We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. To help manage these risks, we engage and rely on external experts and an information technology managed services provider. Our managed services provider's information security analysts and IT security specialists offer us advice on technology, infrastructure, management, and productivity in relation to our information technology capabilities.

companyName: SWK Holdings Corp

ticker: SWKH


text: To address risks from cybersecurity threats, we have implemented and maintain cybersecurity policies and procedures, including an incident response plan, and our managed services provider implements a number of cybersecurity technologies and controls, including but not limited to, vulnerability scans and patch management tools. Our current approach to managing cybersecurity risks is informed by periodic risk assessments conducted by our managed services provider that incorporates elements of a recognized industry framework and evaluates our cyber risk management controls. We have implemented a process for senior management to review assessments performed and determine the appropriate treatment of identified risks.


text: We have also developed a cybersecurity risk management process for our third-party vendors. This process aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity risk profile. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors do, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, see Item 1A "Risk Factors."


text: Related to Cybersecurity Risks We engage a managed services provider as discussed above, which includes services to assist us with the identification, monitoring, and management of cybersecurity risks. Our managed services provider reports periodically to our management team, including our Chief Executive Officer ("CEO"). The CEO briefs the Board on information regarding cybersecurity matters at least quarterly.


text: Our risk manager, along with the CEO, oversee our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The Audit Committee of our Board is tasked with oversight of the management of risks related to cybersecurity. The Audit Committee administers its risk oversight function by receiving periodic reports from members of senior management, including the risk manager and CEO, on areas of identified significant risk to the Company.


text: Cibus has processes designed to protect its information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability practices. The Company's cybersecurity team has dedicated personnel whose responsibilities include preventing and monitoring cybersecurity threats. The team has a cybersecurity incident response plan, which is a dynamic and flexible basic framework that includes processes designed to address interdiction and remediation, conducting initial investigations, gathering and analyzing data, reporting incidents to management, mitigating damage to the Company's informational assets and infrastructure, restoring normal services and system integrity, and implementing actions designed to prevent future cybersecurity incidents.

companyName: Cibus, Inc.

ticker: CBUS


text: Cibus has established procedures to identify, assess, and manage risks across the business, including risks related to cybersecurity. The Company's cybersecurity strategy includes risk management methodologies and analytics, which are designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in its ability to address cybersecurity risks and threats. Organizational risk assessments help management to assess threats and identify and investigate potential vulnerabilities to make risk management decisions and assign resources to mitigate risk. The Company's cybersecurity risk management strategy is incorporated into its business continuity plans, which include plans designed to address disaster recovery at its data centers and its holistic risk assessment procedures. Further, Cibus has a security awareness platform that provides its employees training on a variety of topics.


text: Cibus engages external resources that contribute to and provide evaluation of, its existing cybersecurity practices and organizational risk assessment systems. Further, Cibus has processes designed to identify, assess, and manage third party service provider risks when third parties handle, possess, process, and store the Company's material information.


text: As of the date of this Annual Report, Cibus does not believe that any past cybersecurity incidents have had, or are reasonably likely to have had, a material adverse effect on the Company's business, operations, or financial condition. However, there can be no assurance that the Company's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats, and it is possible that these events may occur and could have a material adverse effect on the Company's business, operations, or financial condition. See "Risk Factors—Risks Related to Cibus' Organization and Operations—Cibus' internal computer systems, or those of its third party contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of Cibus' operations." under the heading "Risk Factors" of this Form 10-K.


text: The Company's cybersecurity team is headed by its Executive Director Global Lead of Information Technology & Information Security, who works with the Company's cybersecurity team to identify cybersecurity risks and who has been in the information technology and cybersecurity industry for over 25 years and holds numerous technical certifications and cybersecurity-related certificates. The team members report via its established cybersecurity triage and outage workflow to the Cibus Cyber Security Council, which consists of the Company's Interim CEO, President, and COO, EVP and CSO, and members of the Company's legal and human resources teams. The Company's Cyber Security Council meets regularly to discuss the status of the cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of the Company's cybersecurity program. The Company's Cyber Security Council is also responsible for identifying, assessing, and managing the Company's exposure to material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats.


text: The Company's full Board of Directors oversees enterprise risks and has delegated oversight to the Audit Committee of the Cibus Board of the Company's data privacy and cybersecurity risks and provides input on the Company's cyber and information security strategy. The Council reports the status of the Company's cybersecurity program to the Audit Committee and, periodically, to the Board. The Board and Audit Committee regularly review these reports and discuss policies with respect to cybersecurity and information technology risks, including how these risks are being identified, assessed, and managed.


text: Our management and Board of Directors (the "Board") recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, business partners, employees, and investors. The Board is involved in our risk management practices. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our systems.

companyName: SANUWAVE Health, Inc.

ticker: SNWV


text: Technical safeguards We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls.


text: Security awareness and training We provide ongoing security awareness and training to educate internal users on how to identify and report potential issues. Phishing emails are discussed on a regular basis with employees to ensure proper protocols are followed. We also provide periodic updates to employees on emerging cybersecurity trends and ways to protect themselves and the Company.


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight, review and discussion with management of the Company's information technology, data security, business continuity, artificial intelligence and cybersecurity-related risk exposures and threats; the potential impact of those risk exposures and threats on the Company's business, operations and reputation; and the processes management has established to assess, manage, monitor and mitigate such risk exposures and threats. The Company's Chief Executive Officer, President, and Chief Financial Officer are responsible for assessing and managing cybersecurity risks. The Company's management periodically reports on cybersecurity issues and presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.


text: Upon verifying that a cybersecurity incident has occurred or is occurring, the Chief Executive Officer, President and Chief Financial Officer will promptly conduct a preliminary assessment of the severity level of the cybersecurity incident. Following this assessment, the Chief Executive Officer will determine whether to report the cybersecurity incident to the Audit Committee, who will then report such cybersecurity incident to the Board as the chair deems appropriate.


text: Material Impact of Cybersecurity Risks We have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— Risks to our Business— We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity breaches and data leakage."


text: As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior Nuveen Real Estate professionals and our Advisor is a subsidiary of TIAA. As such, we are reliant on TIAA for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details TIAA has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Nuveen Global Cities REIT, Inc.


text: Cybersecurity Program Overview TIAA, on our behalf, has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA and the Advisor manage our day-to-day operations and have implemented a cybersecurity program that applies to us and our operations.


text: We depend on and engage various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA, the Company, and other products, subsidiaries and affiliates of TIAA and their respective third-party service providers.


text: This cyber risk management program is integrated into TIAA's overall risk management program. It involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. TIAA relies on its internal subject matter experts and external experts, as needed, including but not limited to cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, applicable to the Company and other products, subsidiaries, and affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company in connection with its day-to-day commercial real estate, investment, and other operations.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. TIAA maintained appropriate cyber security policies and procedures during the 12-month period covered by this report and there were no material cybersecurity issues that affected us. Cybersecurity risk remains heightened to the financial industry, including us, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact our operations. TIAA continues to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers.


text: Our board of directors oversees risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives periodic updates from TIAA's cybersecurity leadership regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: TIAA's management, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including us. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. Management of the Advisor is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Cybersecurity Risk Management and Strategy GitLab's cybersecurity program was designed in alignment with industry standards and recognized best practices to identify, assess, and manage material risks from cybersecurity threats. Our cybersecurity program is led by our Chief Information Security Officer, who has over 25 years of experience working at SaaS and technology companies, and consists of over 120 security practitioners located around the world. Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, and financial impact. Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management including integration into our enterprise risk management program, led by Internal Audit. We also make judgments based on current data, assumptions about the risk, the company's risk tolerance, impact to confidentiality, integrity, and availability, and reasonable analysis of costs associated with mitigating or reducing the severity of the risk. Our global incident response team iteratively evaluates security events for impact, using both qualitative and quantitative factors. Security incidents that are assessed as potentially material are escalated to designated members of our management and board of directors, as applicable. Our global incident response team performs at-least annual tabletop exercises of our incident processes, including material breach, disaster recovery, and business continuity scenarios.

companyName: Gitlab Inc.

ticker: GTLB


text: Our security program accounts for our significant interactions with relevant external third-parties and analyzes the potential risks introduced from doing business with them. These risks are continually assessed throughout the vendor lifecycle from onboarding to offboarding. We also engage in continuous monitoring of our cyber security risks and perform security assurance activities via independent, external third parties such as consultants, auditors, security researchers, and assessors during our robust security certification audits, penetration tests, and bug bounty programs.


text: As of the date of this Form 10-K, to the best of our knowledge and based on available data, we have not experienced a material cybersecurity incident that has resulted in a material adverse impact to our business or operations. However, there can be no guarantee that we will not experience such an incident in the future. See Item 1A Risk Factors of this Annual Report on Form 10-K for more information on our cybersecurity risks and product vulnerability risks.


text: Our board of directors is responsible for overseeing and advising our company so that it functions as effectively as possible. The audit committee consists of a subset of the board of directors. The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. The audit committee performs oversight functions and meets regularly with management to review the company's business and operations, including the oversight of risks from cybersecurity threats. Management is responsible for and regularly discusses identifying, assessing, and managing material cybersecurity risks on an ongoing basis through programs led by the Chief Information Security Officer, Chief Legal Officer, and the Chief Financial Officer.


text: As an externally advised company, our day-to-day operations are managed by our adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior FS Investments professionals and our adviser is an affiliate of FS Investments. As such, we are reliant on FS Investments for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Our business is dependent on the communications and information systems of the adviser, as an affiliate of FS Investments. We also rely on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including us and our operations.


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cybersecurity risks applicable to us. The cybersecurity risk management program involves, among other things, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We rely on FS Investments to engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We are also included in the FS Investments risk management program and processes, which include cybersecurity risk assessments.


text: We depend on and engage various third parties, including suppliers, vendors and service providers, to operate our business. We rely on the expertise of the third-party risk management, legal, information technology and compliance personnel of the adviser and FS Investments, including the Chief Information Security Officer ("CISO"), of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The audit committee of the board of directors (the "Audit Committee"), provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and our Chief Compliance Officer ("CCO") regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees our risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over 10 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as our CCO for over 10 years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to us.


text: Management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology and/or compliance personnel of the adviser and FS Investments.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect us, including our business strategy, operational results, and financial condition.


text: We recognize the critical importance of cybersecurity in protecting our business and our stakeholders' information. We are committed to maintaining a robust cybersecurity risk management program and implementing a comprehensive strategy to mitigate cyber threats and vulnerabilities. Our cybersecurity policies, standards, processes and practices are fully integrated into our overall enterprise risk management program, as described below. This disclosure outlines our cybersecurity risk management approach, strategy, and governance structure.

companyName: FORWARD AIR CORP

ticker: FWRD


text: The Board and the Audit Committee of the Board ("Audit Committee") are actively involved in oversight of our cybersecurity risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our security and the information that we collect as well as proactively identifying and preventing cybersecurity threats.


text: Our cybersecurity program is focused on protecting critical assets, including data, systems and applications; minimizing the impact of cyberattacks; understanding and preparing for the evolving threat landscape and complying with applicable law. The program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board delegated oversight of cybersecurity risk management to the Audit Committee, which regularly interacts with our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including the Information Security Governance team and the Cybersecurity Risk Management team. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also continuously improving our cybersecurity program and maintaining a strong cybersecurity posture. Key to this approach is to broadly assess the potential impact of cybersecurity incidents on business operations and financial stability as well as any legal and regulatory requirements regarding cybersecurity. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection and prevention systems, encryption, multi-factor authentication, privileged access management least privileged access controls, secure coding practices and other security controls, which are regularly evaluated and improved through vulnerability assessments and penetration testing designed to identify weaknesses in our systems and networks. • Incident Response and Recovery Planning: We have a dedicated Incident Response Team dedicated to responding to and recovering from cybersecurity incidents. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including our vendors who handle our data and systems through due diligence and vendor assessments. • Education and Awareness: We provide regular, training for all employees and contractors, which is designed to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We regularly identify and assess cybersecurity risks through a comprehensive program that includes: • Vulnerability assessments and penetration testing: We conduct regular vulnerability assessments and penetration testing to identify and address weaknesses in our systems and networks. • Threat intelligence: We subscribe to threat intelligence feeds and maintain relationships with security partners to stay informed about emerging cyber threats. • Third-party risk assessments: We engage various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties to assist us in identifying, assessing and managing cybersecurity risks. We conduct initial and regular due diligence on third-party vendors who handle our data and systems. • Business impact analysis: We regularly assess the potential impact of cyberattacks on our business operations and financial stability. • Legal and regulatory risk assessment: We assess the legal and regulatory risks associated with cybersecurity incidents and ensure compliance with applicable laws and regulations.


text: As discussed above, our cybersecurity governance structure is integrated into several facets of us, which include: • Board of Directors: The Board has ultimate oversight responsibility for cybersecurity. The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures. • Audit Committee: The Audit Committee is responsible for monitoring the effectiveness of our information system controls and security, including a periodic review of our cybersecurity and other information technology risks, controls, initiatives and action plans. • Chief Information Security Officer (CISO): Casey O'Malley is our CISO and is responsible for the day-to-day management of the cybersecurity program. Casey has had a distinguished career holding IT leadership positions since 2015 and has been employed in the cybersecurity field since 2001. • Information Security Governance: The Information Security Governance team is comprised of our senior executives and oversees the development and implementation of the cybersecurity strategy. • Cybersecurity Risk Management Team: The Cybersecurity Risk Management Team is responsible for identifying, assessing, and mitigating cybersecurity risks. • Incident Response Team: The Incident Response Team is responsible for responding to and recovering from cyberattacks.


text: The management team reports to the Board on cyber risk quarterly. Reports include: • Overall cybersecurity posture: Current state of our security controls and identified vulnerabilities. • Incident reports: Summary of recent cyber incidents, including their nature, impact, and mitigation efforts. • Risk assessments: Updated assessments of potential cyber threats and their potential impact on us. • Security budget and resource allocation: Plans and investments for maintaining and enhancing our cybersecurity program.


text: The management team is required to update the Board immediately once a material breach occurs. The Board is provided timely updates until the incident is considered resolved.


text: Management evaluates cyber incidents based on their materiality, considering factors such as: • Financial impact: Potential losses in revenue, profits, or assets. • Reputational damage: Impact on our brand image and customer trust. • Regulatory compliance concerns: Potential violations of data privacy regulations or other legal requirements. • Operational disruption: Impact on business continuity and ability to deliver services.


text: Based on the materiality assessment, we determine the appropriate disclosure to regulatory agencies, stakeholders, and the public, ensuring transparency and minimizing potential harm.


text: We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. In collaboration with the Company's IT leadership, management has established structured processes for identifying, assessing, and mitigating cybersecurity risks that may impact our business operations including processes to identify cybersecurity risks associated with the use of third-party service providers.

companyName: Oklo Inc.

ticker: OKLO


text: Senior leadership regularly provides updates to the Audit Committee of the Board of Directors on the status and outcomes of internal audits evaluating our cybersecurity systems, controls, and processes. Our program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which serves as a valuable resource in helping us identify, assess, and manage cybersecurity risks aligned with our business needs. This does not imply that we meet any particular standards, specifications or requirements, only that we use NIST as a guide.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shared common methodologies, reporting channels, and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas. Our overall strategy in protecting against cybersecurity risks includes the following preventative and detective measures: • Multi-layered network security architecture – We have implemented firewalls, intrusion detection and prevention systems (IDPS), endpoint detection and response (EDR) solutions, and we utilize threat intelligence. • Incident Response – In the event of an incident, management has established an incident response plan designed to identify, evaluate, respond to, mitigate, and report potential cybersecurity threats, including notifying the Board or regulatory agencies, as deemed appropriate. This response plan is tested regularly and is intended to address cybersecurity risks to the corporate information technology ("IT") environment including the Company's systems, hardware, software, data, people, and processes. • Regular security assessments and penetration testing – We conduct periodic vulnerability assessments and simulated cyberattack exercises to identify and remediate security weaknesses in our IT infrastructure. • Third-party Security Operations Center (SOC) monitoring – We partner with a third-party SOC and incident response retainer to provide security monitoring, threat detection, and rapid incident response, ensuring proactive identification and mitigation of potential cyber threats. • Employee cybersecurity awareness and training programs – All employees are required to participate in cybersecurity training, including phishing simulations, social engineering awareness, and secure data handling practices.


text: Oklo has not experienced any material cybersecurity incidents to date, and we are not aware of any threats, current or ongoing, that would materially affect or be reasonably likely to materially affect our results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we or our third-party providers fail to protect confidential information and experience data security incidents, we may experience adverse effects, including regulatory enforcement consequences, on our business and results of operations."


text: The Board maintains oversight responsibility for cybersecurity risks and has delegated to the Audit Committee oversight of such risks, including oversight of management's implementation of our cybersecurity risk management program. Management regularly reports to the Audit Committee of the Board regarding the status and outcomes of regular internal audits of cybersecurity systems, controls, and processes. As needed, management also briefs the Board on our cybersecurity environment and information security philosophy. We also review and advise our Board of cybersecurity threats to us, including emerging cybersecurity threats, as well as our plans and strategies to address them.


text: Our cybersecurity management team consists of the following: • Chief Financial Officer – previously held roles associated with cybersecurity monitoring and reporting at bp plc, including being accountable for a global smart active monitoring implementation program focused on the North American Downstream business, as well as oversight for IT when serving as the CFO for the NA Fuels business for bp plc and while CFO at Renewable Energy Group. • Head of IT and Cyber – has over 20 years of IT leadership in cybersecurity, including risk management, incident response, and cybersecurity strategy across defense, education, and corporate sectors. He has managed IT and cyber operations for over 100,000 users, overseeing enterprise ERP, HRIS, internet services, email systems, and Security Operations Centers. He holds certifications including CISSP, CCNP, and ITIL. • Head of Business Operations – a seasoned operations and technology leader with extensive experience in scaling IT and cybersecurity functions for high-growth companies. He served as Chief Operating Officer of a Series A startup where he oversaw all operations and IT. • Head of Legal – has extensive experience helping companies manage cybersecurity, privacy, and data protection related risks across the technology, e-commerce, and healthcare sectors. He has served as the global Data Protection Officer at four companies, including at Shopify Inc. where he helped respond to cybersecurity incidents, and managed all related legal and regulatory impact. He also previously managed the cybersecurity function at a Series B startup where he served as General Counsel and Corporate Secretary.


text: All of the above individuals have played a key role in our transition as a public company, working closely with external cybersecurity advisory specialists to evolve IT and cybersecurity practices to meet public company compliance standards.


text: Our management team remains actively engaged in overseeing cybersecurity risk prevention, detection, mitigation, and remediation efforts. This is achieved through regular briefings from our internal IT and cyber staff, with insights from threat intelligence sources, including governmental, public, and private entities as well as guidance from external service providers. Additionally, management reviews alerts and reports generated by advanced security tools deployed within our environment to ensure a proactive and informed approach to cybersecurity threats.


text: We recognize the need to maintain the security and confidentiality of personal information, protected health information and other confidential data that we may collect or use in connection with our business, and the importance of assessing, identifying and managing various cybersecurity risks that may impact our business. Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of hardware, software and technical applications and platforms developed or provided by our third-party service providers, and facilitates coordination across different departments of our company.

companyName: Acutus Medical, Inc.


text: As part of our enterprise risk management process, we assess the various cybersecurity risks that may impact our business and implement plans and initiatives that are intended to mitigate those risks.


text: Our cybersecurity program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, software, and services; (ii) a cybersecurity team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally; (iv) new-hire and annual cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security. Our cybersecurity team is responsible for assessing our cybersecurity risk management program and we also engage a third party for such assessment.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the board of directors (the "Audit Committee"). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Director of IT who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our dedicated personnel are knowledgeable about our products and systems and experienced information systems security professionals and information security managers with many years of experience. Management regularly updates the Audit Committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Related to Our Business and the Products—Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in this annual report on Form 10-K.


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. This includes scanning our internal network and infrastructure at least monthly to enhance security measures and conducting third-party vulnerability testing at minimum on an annual basis to better protect against external attacks. We also use security tools intended to protect our information systems from cybersecurity threats, and to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

companyName: Argo Group International Holdings, Inc.


text: In particular, our information security program and approach are based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The NIST Framework establishes core requirements related to information protection, processes and technologies. In addition, we maintain a Data Protection Framework and various policies, including Information Security Policy, Privacy Policy, and Records & Information Management Policy, to appropriately manage personal information necessary to operate our business and comply with applicable regulations. We also maintain a Third-Party Risk Management Program, including a Vendor Management Policy, which allows us to better oversee, monitor, identify and control certain risks related to the processing of personal information and customer information by our authorized third parties. This program includes categorizing vendor risk based upon the types of service being provided and types of data handled, performing risk assessments using proforma questionnaires, and undertaking reviews of Systems and Organization Controls (SOC) reports for critical vendor relationships.


text: In accordance with these policies, we share personal information with affiliates, business partners, third-party service providers, or vendors only when we have a legitimate business purpose for doing so and it is permissible by law. We require third parties to maintain similar standards to ours to protect personal information. We have implemented a risk mitigation process to identify and assess the cyber posture of third parties providing commodities or services to our legal entities. We also have implemented multiple layers of data protection measures.


text: We have in the past, and may in the future, engage third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. As part of continuous improvement initiative, we strive to mature and build a robust and resilient environment to protect and defend against bad actors. We engage third parties to perform internal and external testing to improve security operations, disaster recovery, and incident response programs.


text: As we have noted, increased adoption of AI technologies, especially Generative AI, may increase cybersecurity risks, so Argo Group has instituted an AI Policy specifically addressing such risks. Additionally, we have implemented additional technical controls to help safeguard against data loss to generative AI and have established a cross-functional AI Working Group, which meets on a periodic basis to ensure that the company remains abreast of any AI developments that may require changes to our security posture.


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Refer to the risk factors under "Operational Risks" in Part I, Item 1A, "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board oversees the Company's risk management process, including on cybersecurity risks, directly and through committees to which the Board has delegated authority. The Company's Audit & Risk Management Committee is responsible for overseeing our internal controls, including cybersecurity and data protection programs, and reviews the effectiveness of our financial reporting processes and internal controls, including data privacy, information technology security and control. Meetings of the Audit & Risk Management Committee often include discussions of specific risk areas, including, among others, those relating to cybersecurity. The Audit & Risk Management Committee also frequently discusses, in accordance with its duties and responsibilities as enumerated in its committee charter, the policies, guidelines and process by which management assesses and manages risks related to data protection and cybersecurity, including assessments of the overall threat landscape, steps management has taken to monitor or mitigate its risk exposure and related strategies and investments. Our Chief Information Officer and Chief Information Security Officer regularly reports on data protection and information technology security matters to the Audit & Risk Management Committee and to Argo senior management via Security Governance Council meetings.


text: As discussed above, our information security program and approach are based on the NIST Framework, and we have implemented cybersecurity policies, processes and practices designed to monitor and address cybersecurity threats and incidents. Our Chief Information Security Officer, under the guidance of the Chief Information Officer and in coordination with the Head of Risk, Head of Operations, and General Counsel, is responsible for leading the assessment and management of cybersecurity risks. Our Chief Information Security Officer holds the Certified Information Systems Security Professional (CISSP) designation, has over 20 years of experience working in information security, data protection and privacy, and regularly receives reports from our threat intelligence resources, in concert with enterprise risk, and legal departments, on cybersecurity threats and incidents.


text: In addition, plans have been authored to assist our security, legal, and finance functions in assessing and managing Argo's material risks from cybersecurity threats, and we conduct tabletop exercises and training sessions at least annually to help ensure effectiveness of said plans. Additionally, we also utilize outside resources to assist and participate in the determination of materiality of incidents stemming from cybersecurity threats.


text: Our Board of Directors assigned specific oversight responsibility for cybersecurity to our Audit Committee, which also oversees our general risk management. The Audit Committee reviews and discusses with management our policies, practices, and risks related to information security and cybersecurity.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: Our Chief Executive Officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. To strengthen our cybersecurity posture, we engage with external consultants for regular risk assessments, penetration testing, and vulnerability analyses, allowing for proactive identification and mitigation of potential threats. We also rigorously verify the cybersecurity practices of our third-party service providers, vendors, and partners, conducting due diligence before establishing relationships and ongoing monitoring to verify compliance with our cybersecurity standards.


text: Our Principal Financial Officer provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.


text: We maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Director of Operations & Information Technology to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST).


text: Our information technology department diligently monitors our daily operations, overseeing the security of our computer networks through implemented systems and processes aimed at safeguarding sensitive data. Utilizing encryption and authentication technologies, we fortify our systems against unauthorized access and data loss. This proactive approach ensures the integrity and confidentiality of our data, mitigating potential risks posed by cyber threats.


text: In assessing cybersecurity risks, we adopt a risk-based approach, particularly concerning third-party vendors integral to our operations. Vendors meeting specific criteria, including ownership and operation of information technology networks critical to our operations, undergo evaluation across various domains such as data security and operations management. Effective communication channels with these vendors are maintained to enable timely notification of any cybersecurity incidents that could impact our company.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems. For more information, please see Item 1A. Risk Factors - Increased Information Technology ("IT") security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services.


text: Our Director of Operations & Information Technology regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team.


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our Director of Operations & Information Technology, Director of Risk Management and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants.


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our Information Technology team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber-attacks.


text: An important part of our business involves the receipt, storage and other processing of personal information of our customers and associates, including, in the case of our customers, payment information. Security of this information and our other proprietary or sensitive data is imperative to ensure the trust of our customers, vendors, and associates. We assess, identify and manage material risks related to potential cybersecurity attacks on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems through various processes. These processes include a wide variety of controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft and misuse, and unauthorized access to, or other cybersecurity attacks or vulnerabilities affecting, our data and information technology systems.

companyName: GameStop Corp.

ticker: GME


text: The assessment of cybersecurity risk is integrated into our overall risk management processes and cybersecurity is identified as a key risk within our Enterprise Risk Management ("ERM") program. The Company strives to implement cybersecurity policies, standards, processes and controls for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity attacks that are aligned with industry best practices and applicable frameworks.


text: We have an information technology ("IT") security team, led by our chief information security officer, that is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. We seek to address cybersecurity risks through a cross-functional approach, including relevant training for applicable associates and regular reviews and tests of our cybersecurity program that leverage audits performed by our internal audit team. In addition to our in-house cybersecurity capabilities, at times we also engage consultants or other third parties to assist with assessing, identifying and managing cybersecurity risks.


text: We use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. We maintain processes designed to reduce the impact of a cybersecurity attack or other compromise at a third-party vendor.


text: We maintain a cybersecurity incident response plan, which details the incident response procedures and points of contact related to the response processes. The response plan includes a decision-tree-based playbook, which is a supplement to the plan, and focuses on specific types of incidents and the appropriate response steps.


text: As of the date of this report, we are not aware of any recent cybersecurity attacks that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our data and information security systems.


text: As indicated above, we have an IT security team, led by our chief information security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. The security team's leadership has an average of 13 years of prior work experience in various roles including monitoring, response, compliance and privacy. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: The Audit Committee of the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cybersecurity attacks or other compromise. The Company's IT team consults with, and provides regular updates to, our Audit Committee, as well as members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of our cybersecurity program, and timely reports regarding any cybersecurity attack that meets established reporting thresholds. Our Audit Committee has oversight responsibility for our cybersecurity program.


text: We have established a comprehensive, enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. This program is seamlessly integrated into our overall risk management and internal control systems, subject to regular reviews by senior management. It significantly enhances the security, confidentiality, integrity, and availability of the personal and sensitive information we collect, create, use, and maintain.

companyName: CuriosityStream Inc.

ticker: CURI


text: By conducting regular risk assessments, we believe we effectively manage both internal and external cybersecurity threats. Our cybersecurity strategy is specifically tailored to our organization's size, scope, and business needs, emphasizing the protection of customer and employee data. Our security infrastructure includes advanced tools and protocols, such as firewall protections, secure user authentication, and up-to-date antivirus and internet security software, which we believe are fundamental components of our operational protocols designed to mitigate vulnerabilities and efficiently address security incidents.


text: We also assess and manage cybersecurity risks associated with our third-party service providers. We require the implementation of security measures that align with our established security policies and protocols as well as compliance with applicable legal requirements.


text: The ongoing improvement of our cybersecurity measures is overseen by our Vice President of Engineering, who has 17 years of experience in software and security, along with a bachelor's degree in Computer Engineering. As part of our Chief Operating Officer organization, he manages the Information Technology team and the designated Data Security Coordinator, ensuring regular program reviews, risk assessments, and employee training sessions to strengthen our proactive security posture. We do not employ or engage any third parties for cybersecurity consulting or monitoring, aside from technical support teams from our application vendors.


text: In the normal course of business, we proactively manage and monitor cybersecurity activities. To date, these efforts have successfully prevented any incidents that could materially affect our business strategy, operational results, or financial condition. We remain vigilant and are not currently aware of any threats that pose a material risk.


text: We believe our detailed incident response procedures enable us to effectively manage and mitigate the impacts of security breaches. Continuous monitoring and post-incident analysis further refine our security strategies, enhancing our protective measures. Our Board and the Audit Committee provide oversight over our cybersecurity efforts and stay regularly informed on cybersecurity matters, including emerging risks and mitigation strategies, to ensure informed governance over our enterprise risk assessments and cybersecurity approach. Cybersecurity matters are discussed regularly with senior management, and any significant cybersecurity events are promptly reported to the Board.


text: For additional information about cybersecurity risks, see Risk Factors, Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, harm to our reputation, disclosure or destruction of data, including user and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business.


text: Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations, and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: We have implemented a cybersecurity program in accordance with our risk profile and business that includes, among other things, written policies, monitoring and filtering procedures, and employee training. We have also developed an incident response policy and procedure designed to facilitate the timely reporting and assessment of cybersecurity incidents.


text: Our cybersecurity risk management program, which is part of our enterprise risk management program, aims to identify risks related to the Company, including risks from cybersecurity threats. Our cybersecurity risk management program includes a number of components, including informal self-assessments and audits, penetration testing, and vulnerability assessments, that are conducted periodically by both internal and external resources. The Company also analyzes current and emerging cyber threats that pose a risk to the organization using various threat intelligence tools and services.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the review of vendors' SOC 2 Type 2 reports and a vendor security questionnaire.


text: Related to Cybersecurity Risks Our Director of Infrastructure, Operations and Cybersecurity, who has over ten years of experience managing organizational operations, security and infrastructure, manages the Company's cybersecurity program. We have a cyber subcommittee (the "Subcommittee"), which includes members of our finance, legal, and IT departments, that meets periodically to discuss the Company's ongoing cybersecurity efforts. The Subcommittee reports to the Chief Operating Officer ("COO") and Chief Financial Officer ("CFO"), who report outputs from the Subcommittee regarding potential cybersecurity risks to the Company's executive team and the board. The Director of Infrastructure, Operations & Cybersecurity is responsible for the day-to-day monitoring and remediation of cybersecurity risks.


text: The board is responsible for informed oversight of our risk management process. The board administers this oversight function through various board standing committees that address risks inherent in their respective areas of oversight. The board has delegated oversight for cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company's policies and procedures with respect to cybersecurity risk management.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, see Item 1A. Risk Factors.


text: The strategy followed by our Security Incident Response Team ("SIRT") for managing material risks from cybersecurity threats is aligned to the National Institute of Standards and Technology's ("NIST") Cyber Security Framework 1.1 and its associated references in NIST SP 800-53r5.1.1 and NIST 800-61r2 Guides. The strategy was updated in the fourth quarter of 2023 to support our compliance with the SEC's Rules on Cybersecurity Disclosure for Public Companies and then it was reviewed in the fourth quarter of 2024 as part of our yearly review cycle and is included in our overall enterprise risk management program.

companyName: Satellogic Inc.

ticker: SATL


text: Our Incident Detection and Response ("IDR") processes and practices include the evaluation of each identified cybersecurity threat event to determine its authenticity and potential impact or whether our systems blocked or mitigated it. Our Incident Response Standard, governed by our Incident Response Policy comprises two separate workflows, both tracked in a ticket system. The first workflow encompasses all events requiring investigation. If an event is confirmed as positive and has caused an impact, a second workflow may be triggered, engaging the Materiality Determination Committee until the incident is reported to the SEC or otherwise determined that there is no material impact.


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, we also: • Use MFA based authentication and other cryptographical processes to address identity-based cybersecurity risks. • Use context aware access control processes. • Adopted processes to ensure security in specific remote environments. • Have implemented anti-phishing technologies. • Deploy anti-malware solutions, and have them continuously updated. • Implemented a SIEM system, where we monitor (automatically and otherwise) our networks, systems and users. • Perform periodic network and vulnerability scans of our external and internal networks and systems. • Have an incident detection and response team, with its policies and procedures, to review all events that may be part of a security incident. • Use processes to assess and prioritize risks related to applications and how we use them. • Ensure the asset inventory for relevant system components is kept current and accurate; • Maintain updated network and systems architecture documentation • Periodically engage well known external consultants, where appropriate, to assess, test or otherwise assist with aspects of our security controls. • Provide mandatory training on security and compliance matters to all employees, and some more specific as roles and responsibilities require. • Have defined and periodically updated our information security policies regarding, among others, access and control, networked devices, credentials management, physical security, etc. • Implement a secure software development life cycle and a maturity model to assess it, and accompany engineering teams during all the phases of the cycle. • Evaluate the information security risk associated with suppliers, partners, applications and services used.


text: We have established a committee specifically dedicated to determining the materiality of cybersecurity incidents (the "Materiality Determination Committee"), which includes key members of our organization: the CFO, Chief Information Security Officer ("CISO"), and the Sr. VP of Operations, the latter having ultimate oversight responsibility for compliance matters. Once a threat event is determined to have any impact, the committee is assembled, informed and the threat event's material impact is determined. If materiality is confirmed, then the reporting process starts in accordance with SEC rules (including reporting no later than four days after the materiality determination).


text: External help may be engaged at any step in the process, before or after the materiality committee is invoked, depending on the complexity and reach of the incident. Though we do not have a retainer on any external third parties, we have identified a list of potential entities to engage when needed.


text: We have not identified any cybersecurity incident that had or may have a material impact on our business whatsoever, in particular, no unauthorized access to our information technology systems that either occurred or is reasonably likely to have occurred, including of reports submitted to us by third parties (including regulatory agencies, law enforcement agencies and security consultants), to the extent that such unauthorized access to our information technology systems is reasonably likely to have a material effect on the (consolidated) financial statements, in each case or in the aggregate, and no ransomware attacks when we had been asked, paid or are contemplating paying a ransom, regardless of the amount. However, conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology are assumed to be vulnerable to cybersecurity attacks and other data security threats. These types of attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target.


text: Our Board has ultimate oversight for risks relating to our cybersecurity strategy. In addition, the Board has delegated primary responsibility to the Audit Committee for assessing and managing data privacy and cybersecurity risks, reviewing steps management has taken to monitor and control such cybersecurity risks, and regularly inquiring with our management team and internal auditors in connection therewith. The Audit Committee performs quarterly reviews of any confirmed cybersecurity incident. Additionally, on a bi-annual basis, the Audit Committee receives a comprehensive update regarding any cybersecurity events occurring during the prior period, progress of cybersecurity programs, changes in cybersecurity policies, and ongoing assessments of risks and mitigation activities, and to discuss the evolution of our cybersecurity strategy. The information in these reports and the results of these discussions are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.


text: The process for materiality determination of a cybersecurity threat event considers the possibility of contacting the Audit Committee for assistance, if needed, or to inform of the evolution of an incident with possible material impact.


text: Our Materiality Determination Committee is tasked with determining the materiality of cybersecurity incidents. Also, every week the CISO updates the Executive Leadership Team (CEO, President, CFO, Sr. VP of Operations, Chief Technology Officer ("CTO"), Chief Product Officer ("CPO"), and Sr VPs of Engineering) on cybersecurity matters including any confirmed incident or any possible threat with a material or otherwise meaningful impact and shares an updated dashboard with key performance indicators on on-going efforts and long-term metrics.


text: The CISO is directly responsible for directing, "all cyber related activities (including monitoring, preventing, detecting, mitigating, and remediating" and informing the Audit Committee of any cybersecurity incident or threat with material impact, including such threats associated with our use of external suppliers and other third-party service providers.


text: The CISO and VP of Information Security have more than 25- and 30-years' experience, respectively, working directly in the cybersecurity industry, performing and coordinating red-teaming and blue-teaming exercises, conducting research and developing cybersecurity tools and products, as well as presenting at various international conferences.


text: The Information Security Team is segmented into three distinct sections: IDR, Secure Development ("SDLC"), and Infrastructure and Access Control ("IAC"). Furthermore, it collaborates with our product groups to integrate security measures into our products and services, thereby enhancing the overall security posture for our customers.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to associates or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. These cybersecurity risks and other company risks are monitored and integrated into our enterprise risk management process. As part of this process, appropriate personnel consult with subject matter specialists as necessary to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Our cybersecurity risk management approach includes: (i) an enterprise risk management process, which includes cybersecurity risks and is periodically refreshed; (ii) system vulnerability scanning; (iii) cybersecurity training for employees; (iv) penetration testing, which simulates cyber threats; and (v) t hird-party risk management for suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that allow for periodic auditing. We work to continually improve each of these processes with the goal of ensuring our cybersecurity strategy remains consistent with industry best practices.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident. Further, we conduct periodic tabletop exercises to test our cyber incident response plan.


text: As part of our cybersecurity risk management strategy, we periodically engage with assessors, consultants and other third-parties to evaluate and test our systems. We also engage an independent Qualified Security Assessor to review our Payment Card Industry compliance.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition. See "Risks Related to Technology" included as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents have been immaterial.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Audit and Finance Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit and Finance Committee receives an overview covering current and emerging cybersecurity threat risks and the Company's ability to mitigate those risks, and discusses these topics with our Chief Information Security Officer and Chief Technology and Digital Officer. Cybersecurity risk management is also considered at least annually during separate Board of Directors meeting discussions with management.


text: Our cybersecurity risk management strategy process is led by our Chief Information Security Officer, and Chief Technology and Digital Officer, and leverages the expertise of our Chief Financial Officer, General Counsel and Chief Accounting Officer. Our Chief Information Security Officer and Chief Technology and Digital Officer have extensive prior work experience in roles involving managing information security, developing cybersecurity strategy, managing incident and breach response and implementing effective information and cybersecurity programs as well as several relevant degrees and certifications.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: We employ a defense-in-layers approach in our cybersecurity program that includes various processes to identify, assess, prioritize, manage, and report on cybersecurity risks that could result in loss or other adverse consequences to Pure Storage. We maintain a variety of channels designed to identify risks, including risks associated with our use of third-party service providers, such as by conducting vulnerability assessments, reviewing audit findings, discussing with key stakeholders, and analyzing security incidents and reports from our employees and others.

companyName: Everpure, Inc.

ticker: PSTG


text: We maintain procedures and processes designed to evaluate and respond to certain identified risks. We assess potential adverse impact across a variety of factors, such as financial, product roadmap, brand and reputation, operational performance, and our ability to comply with applicable laws and regulations. Potential responses for cybersecurity risks are: • Avoiding activities or situations that could lead to harm. • Engaging in preventative measures, safety protocols, and security enhancements. • Transferring risk through contract or insurance. • Developing contingency plans to address potential negative outcomes associated with cybersecurity risks if they occur.


text: Our cybersecurity program is integrated into our broader enterprise risk management framework. For example, certain members of our executive management evaluate material risks from cybersecurity threats against our overall business objectives and report to our Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats. These service providers provide services such as threat intelligence and dark web monitoring. In addition, we engage independent third parties (such as assessors or consultants) to periodically assess the capability and maturity of our cybersecurity program.


text: Our Governance, Risk, and Compliance (GRC) team oversees our third-party cybersecurity risk management program, which evaluates the security posture of certain third-party vendors. Our assessments may include the collection and verification of various cybersecurity measures implemented by our third-party vendors. Depending upon the third-party vendor as well as the data and information systems to which the vendor will have access, the GRC team may review the vendor's information security policies and standards, examine the vendor's certifications and attestations, and review vulnerability assessments or other evaluations.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us, our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect our company in the future and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled "If our security measures, or those maintained on our behalf, are compromised, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, products, communications or data is compromised, limited, or fails, our business could experience a material adverse impact, including without limitation, a material interruption to our operations, harm to our reputation, a loss of customers, significant fines, penalties and liabilities, or breach or triggering of data protection laws, privacy policies or other obligations."


text: Our Board of Directors addresses the company's cybersecurity risk management as part of its general oversight function. Our Risk Committee is responsible for overseeing the company's cybersecurity risk management program, including accepting, transferring, or mitigating cybersecurity risks as appropriate. In addition, we have established an Executive Security Council (ESC). The ESC oversees and governs our cybersecurity program.


text: Our cybersecurity program is implemented and maintained by Pure's Global Information Security Office (GISO), a team of security professionals responsible for developing and implementing an information security program designed to protect our assets, including data, networks, applications and people, from cyber threats. The GISO includes individuals with expertise in the following areas and who continue to leverage such expertise at the company in the following manners: • Governance, Risk & Compliance (GRC). Maintaining cybersecurity policies, standards, and processes as well as providing training to our employees on them. • Security Operations. Monitoring our critical systems and assets to identify and respond to security incidents in a timely manner. • Security Engineering & Architecture. Implementing risk-based security controls. • Product Security. Supporting our product teams' security objectives by providing design review, certification management, penetration testing, and consulting services, as well as operating security vulnerability management and reporting dashboard capabilities. • Enterprise resiliency. Developing policies, procedures and practices for critical operations recovery and business continuity in the event of a cybersecurity incident.


text: The GISO reports to our Risk Committee and ESC on cybersecurity risks. Our Chief Information Security Officer (CISO) meets with the ESC and Risk Committee periodically in an effort to review the company's cybersecurity risks, the company's prevention, detection and remediation efforts of cybersecurity incidents (as appropriate), and key cybersecurity performance indicators. We also maintain procedures designed to escalate certain cybersecurity risks and incidents to members of executive management and the board of directors, as appropriate.


text: Our risk management program is designed to identify, assess and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cyber security component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Technology Officer, who reports directly to our President and Chief Executive Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing and/or implementing new products, services and technology. We leverage people, processes and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detection tools designed to monitor, block and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems and network architecture, using internal cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Cyber Incident Response Procedure that provides a documented framework for responding to actual and potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees and to the Enterprise Risk Committee of our Board of Directors. The Cyber Incident Response Procedure is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Cyber Incident Response Procedure facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Cyber-attacks or other security breaches could adversely affect our operations, net income or reputation" in Item 1A. Risk Factors.


text: Management Committee Oversight The Company has established an Information Risk Management Subcommittee, chaired by the Chief Information Security Officer and supported by leaders from departments across the Company. The Cybersecurity function is provided by qualified financial service technology professionals, with extensive certifications and/or advanced degrees in cybersecurity. Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution. The subcommittee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats. Policies are also shared with the Enterprise Risk Management Committee to provide an additional second line review in alignment with Enterprise Risk functions. All Information Security activity is lead by the Chief Information Security Officer, which includes developing and implementing the information security program and reporting cyber security matters to the Board. The Chief Information Security Officer has many years of experience leading cybersecurity governance and operations in financial services, supported by staff cybersecurity specialists. Management provides cybersecurity statistics and details to the Board quarterly.


text: Board Committee Oversight The Company's Board Enterprise Risk Committee provides oversight of the cyber program. The Committee consists of Board members, chaired by an independent director. Committee members have extensive experience in various disciplines including risk management, communications, litigation, banking and transactional matters, and regulatory compliance. The Board Committee receives regular reports informing on the effectiveness of the overall cybersecurity program and the detection, response, and recovery from significant cyber incidents. Cybersecurity metrics are reported quarterly to the Committee and Key Risk Indicators are reported.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information syst ems or any information residing therein.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: We adhere to industry-leading frameworks to safeguard our systems and data. The primary framework we follow is the HITRUST Common Security Framework (CSF). The HITRUST CSF provides a comprehensive, scalable, and technology-neutral approach to regulatory compliance and risk management. It encompasses information security risk management controls, including risk assessment, mitigation, and evaluation. Our processes for assessing, identifying, and managing material cybersecurity risks align with HITRUST CSF guidelines.


text: We conduct monthly risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation processes.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our human resources and information technology departments. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.