text: We have established structured processes and mechanisms, including incident reporting and escalation, a comprehensive incident response plan, and communication plans, in the event a vulnerability is exploited or an attack is successful. These communication plans consist of internal reporting and communication, including to the Chief Information Officer and the Chief Information Security Officer, as well as external reporting, including notifying the proper agencies, management, and the Board of Directors. The Chief Information Officer and the Chief Information Security Officer report the risks from cybersecurity threats, the level of risk, and any material cybersecurity incidents to the Board of Directors, as well as annually review with the Board of Directors the budget, utilization of systems, processes, and controls in place to address cybersecurity risks and management. The Chief Information Officer and/or the Chief Information Security Officer update the Board of Directors no less than quarterly on material developments in these areas. For more information on our information technology investments and their effects on our results of operations, refer to "Management's Discussion and Analysis of Financial Condition and Results of Operations – Overview," and for more information regarding risks related to our information technology, refer to "Risk Factors – Risks Related to Our Technology Infrastructure."


text: Our Information Security Efforts Cybersecurity Risk, Management, and Strategy The performance, reliability, and security of the networks and technology infrastructure we use or rely on is critical to our operations, our institutions' reputation, and our ability to attract and retain students. We have developed what we believe to be a robust cybersecurity program that incorporates a process of identifying and managing cybersecurity risks across the enterprise. As part of our cybersecurity risk management process, we identify risk by reviewing the elements within our technology stack and processes, including a full scan and identification process designed to cover all APEI's digital and physical assets within the organization, covering hardware, software, data, and personnel. Assets are documented and assessed for their value, factoring in their significance and potential cost if compromised. We conduct a threat assessment for both internal (e.g., employees, contractors, etc.) and external (e.g., hackers, malware, etc.) cybersecurity threats, and we have established plans and actions to detect unauthorized activities. We engage third-party consultants to perform assessments, including annual penetration testing, and we maintain a risk register. The risk register includes documentation of identified risks, the potential impact and likelihood of occurrence, mitigation efforts and the required enterprise level response. Each of the identified risks is given a risk classification from low to high depending on the probability of occurrence and the severity of impact.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI

secItem: Item 1C


text: At least annually, we conduct tabletop exercises to simulate various attacks, enhancing our preparedness against potential threats. These tabletop exercises are conducted with the support of third-party cybersecurity experts. We perform continuous monitoring and detection of our systems, networks, and data repositories for suspicious activities by leveraging a third-party that provides 24x7 comprehensive monitoring of activity that is outside the normal patterns for our day-to-day operations. Our information security team works to stay up to date on threat intelligence through partnerships with outside agencies. We accumulate security event data into our security information and event management, or SIEM, tool that tracks and monitors events providing a comprehensive view of how to respond to various threats.


text: We also have an internal information technology audit team that routinely scans the environment and documents our compliance efforts with regulations and standards that govern our business, such as the Sarbanes-Oxley Act, the Payment Card Industry Data Security Standard (PCI-DSS), the Health Insurance Portability and Accountability Act, FERPA, and the Gramm-Leach-Bliley Act Safeguards Rule.


text: Cybersecurity threats continue to evolve with the use of emerging technologies, such as AI. These threats can disrupt operations, compromise sensitive data, and erode trust. We strive to make sure that employees and contractors are up to date with their responsibility and understand the importance of their contributions to staying cyber secure through a robust training and education program. Employees and contractors are responsible for taking mandated cyber training on an annual basis. We also run phishing exercises on a routine basis to help ensure employees and contractors can recognize and report inappropriate activity and social engineering attempts.


text: We have a process of continuous improvement by incorporating lessons learned from attempted attacks and feedback from phishing exercises, among other learnings. We also have a third-party risk management process pursuant to which new and existing vendors undergo a structured review of their controls and systems, as well as a periodic review from our security team to help ensure vendors protect our data and systems. We seek to require our third-party vendors contractually to maintain a level of security that is acceptable to us.


text: We have not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We maintain specific insurance coverage to mitigate losses associated with certain cybersecurity incidents that impact our or our third parties' information technology and information systems, but there can be no assurance that coverage would be adequate in relation to any incurred losses.


text: Our cybersecurity risk management process is a standalone process, but it is integrated with and informs our overall enterprise risk management program.


text: Cybersecurity Governance APEI's Information Security Steering Committee, or the Steering Committee, consisting of the Chief Information Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel, and the Chief Human Resources Officer, provides a level of oversight over our cybersecurity program. The Steering Committee meets quarterly and is briefed, among other things, on our cybersecurity program, how we are mitigating risks, any notable events that occurred, and phishing campaign results. In addition, the Steering Committee reviews the program for the proper funding and staffing of the information technology security department as well as alignment of the program with our strategic objectives. The Steering Committee reviews and ratifies security policies and helps ensure the proper controls are in place and being followed. The Steering Committee is a critical element to review the cybersecurity program against applicable federal and state regulations and its progress for planned improvements.


text: Our Chief Information Officer and Chief Information Security Officer have the primary responsibility for assessing and managing our material risks from cybersecurity threats. Both the Chief Information Officer and Chief Information Security Officer have extensive experience in running and managing a cybersecurity program both in commercial enterprises and government agencies. In assessing and managing our material risks from cybersecurity threats the Chief Information Officer and Chief Information Security Officer utilize real time monitoring tools, alerts, and dashboards, proactively hunt for threats, and assess capabilities through penetration testing and table top exercises, as well as access and utilize third party resources.


text: We have established structured processes and mechanisms, including incident reporting and escalation, and a comprehensive incident response and communication plan, in the event of a cybersecurity incident. These plans consist of internal reporting and communication, including to the Chief Executive Officer, Chief Financial Officer, and General Counsel, and, as appropriate, management, as well as external reporting, including notifying the Board of Directors, and proper agencies as appropriate. The Chief Information Officer and the Chief Information Security Officer report significant risks from cybersecurity threats, the level of risk, and any material cybersecurity incidents to the Board of Directors, as well as annually review with the Board of Directors the budget, utilization of systems, processes, and controls in place to address cybersecurity risks and management. The Chief Information Officer and/or the Chief Information Security Officer update the Board of Directors no less than quarterly on significant developments in these areas. For more information on our information technology investments and their effects on our results of operations, refer to "Management's Discussion and Analysis of Financial Condition and Results of Operations – Overview," and for more information regarding risks related to our information technology, refer to "Risk Factors – Risks Related to Our Technology Infrastructure".


text: Cybersecurity Incident Impact We have experienced, and expect to continue to experience, cyber threats and incidents. As previously disclosed, on July 23, 2023, we experienced a cybersecurity incident affecting certain of our data and IT systems. As a result of the cybersecurity incident, we incurred $14.3 million of costs in connection with this event. Following a forensic investigation in connection with the incident, we concluded there was no material impact to our financial results for the year ended 2023.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: We also implemented additional security measures following the incident, such as stronger privileged access policies and enhanced and expanded multi-factor authentication to help prevent unauthorized access to our systems. We face ongoing risks from certain cybersecurity threats, and we cannot provide assurance that, if those risks materialize, our business strategy, results of operations or financial condition will not be materially affected in the future. See "Risk Factors" in ITEM 1A of this Annual Report on Form 10-K for more information on our cybersecurity related risks.


text: Risk Management and Strategy Enterprise Risk Management. We utilize an enterprise risk management process undertaken on an ongoing basis pursuant to which we seek to identify various enterprise risks related to product safety and regulatory, global environmental exposure, site environmental matters, IT system interruption and cybersecurity, supply chain matters, business continuity, health and safety incidents, and other matters. We have an enterprise risk management group that manages this process, which includes our executive leadership team. Their activities include assessing the risks, prioritizing the risks, measuring the risks, implementing mitigation plans, and auditing the results.


text: We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to disruption of business operations or financial reporting systems, intellectual property theft; fraud; violation of privacy laws and other litigation and legal risk; and reputational risk, as part of our overall risk management system and processes. We address cybersecurity risks and threats through a strategic program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our dedicated cybersecurity team oversees and implements our cybersecurity management program, compliance with applicable legal and third-party data protection and data privacy requirements, and our incident response and crisis management plans.


text: We have established an information security policy and incident response and crisis management plans. We continue to regularly test and evaluate the effectiveness of those plans. Our incident response and crisis management plans address and guide our employees, management and the Board on our response to a cybersecurity incident.


text: Our cybersecurity team provides ongoing information security awareness education, including simulated phishing training, and cybersecurity training for our employees.


text: External Advisors. We, along with our Board and its committees, engage outside advisors where appropriate to assist in the identification, oversight, evaluation and management of the risks facing our business, including cybersecurity risks. Advisors may be engaged either on a regular basis to inform the Board or management of ongoing risks, or occasionally to advise on specific topics. Such advisors include law firms, cybersecurity experts and other consultants.


text: External Assessments. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants. Cybersecurity processes are adjusted based on the information provided from these assessments. In addition to annual attack and vulnerability testing, we engage a third-party cybersecurity provider for managed detection and response and as a managed security operation center.


text: Our Board of Directors is ultimately responsible for overseeing and reviewing with management the Company's cybersecurity risks and the policies and practices established to manage such risks. In that effort, the Board delegates these responsibilities to the Audit Committee. The Audit Committee receives a cybersecurity update at each of its quarterly meetings from our Senior Vice President, Chief Information Officer ("CIO") or management. These updates address a range of topics, including updates on technology trends, policies and practices, and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats.


text: Our CIO, as the leader of our IT organization, is responsible for executing enterprise, product and manufacturing cybersecurity programs with a focus on security architecture, vulnerability testing, cyber risk management, incident response, vulnerability management, intelligence, awareness and training and governance. Our CIO and IT management team meet regularly to develop and oversee strategies to protect our data, systems and technology across the organization. These strategies include reviewing security performance metrics, identifying security risks and assessing the status of approved security enhancements. Our CIO receives regular updates from our IT management team on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation. The IT organization also makes recommendations on security policies and procedures, security service requirements and risk mitigation strategies.


text: Our CIO has worked in the information technology industry since 1997 and has led our IT function since 2016. The IT management team responsible for developing and executing our cybersecurity policies is comprised of individuals with extensive experience working in the fields of information technology and cybersecurity, formal education and degrees in information technology and cybersecurity and industry certifications such as Certified Information Systems Security Professional, Certified Information Security Manager and Certified Information System Auditor. Our CIO and IT management team also receive regular training and education on cybersecurity-related topics.


text: Risk Management and Strategy Enterprise Risk Management. We utilize an enterprise risk management process undertaken on an ongoing basis pursuant to which we seek to identify various enterprise risks related to product safety and regulatory, global environmental exposure, site environmental matters, IT system interruption and cybersecurity, supply chain matters, business continuity, health and safety incidents and other matters. We have an enterprise risk management group that manages this process, which includes our executive leadership team. Their activities include assessing the risks, prioritizing the risks, measuring the risks, implementing mitigation plans and auditing the results.


text: We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to disruption of business operations or financial reporting systems; intellectual property theft; fraud; violation of data privacy laws and other litigation and legal risk; reputational risk; and risks associated with our use of third-party service providers, as part of our overall risk management system and processes. We address cybersecurity risks and threats through a strategic program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our dedicated cybersecurity team oversees and implements our cybersecurity management program, compliance with applicable legal and third-party data privacy requirements and our incident response and crisis management plans.


text: We also implemented additional security measures following the previously disclosed cybersecurity incident of July 2023, such as stronger privileged access policies and enhanced and expanded multi-factor authentication to help prevent unauthorized access to our systems. We face ongoing risks from certain cybersecurity threats, and we cannot provide assurance that, if those risks materialize, our business strategy, results of operations or financial condition will not be materially affected in the future. See "Risk Factors" in ITEM 1A of this Annual Report on Form 10-K for more information on our cybersecurity related risks.


text: We depend heavily on various information systems and electronic resources to conduct our business operations. Additionally, a majority of our clients, service providers, and other business partners on whom we rely, including providers of our online banking, mobile banking, and accounting systems, utilize their own electronic information systems. Any of these systems are susceptible to compromise, whether by employees, clients, or other authorized individuals, by malicious actors employing sophisticated and continuously evolving software, tools, and strategies. Given our status as a financial services provider and our relative size, we and our business partners are considered high-value targets for such malicious actors. For further details, please refer to the "Risks Related to Information Security and Business Interruption" section of As a result, we have devoted significant resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program; Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats; Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time; Managing and maintaining cybersecurity controls utilizing available people, processes and technology; Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers; Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: Collaborating with third-party cybersecurity consultants, who perform regular penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in our systems and processes; Providing regular cybersecurity training for both our employees and Board of Directors.


text: The Information Security Program, overseen by our Executive Project and Technology Risk Committee ("EPTRC"), plays a vital role in our overall risk management system. It encompasses administrative, technical, and physical measures aimed at safeguarding the security and confidentiality of client records and information. We also have an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response team (i) includes subject matter experts to address cyber threats and (ii) includes members of management responsible to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice.


text: Occasionally, we have encountered cybersecurity threats necessitating adjustments to our procedures and the integration of extra safeguards. Although these specific threats or incidents haven't significantly impacted us thus far, it is possible that future threats and incidents we detect could potentially have a material adverse effect on our business strategy, results of operations, and financial condition.


text: Our management team is tasked with the daily management of the cybersecurity risks we encounter and supervises the EPTRC. Our EPTRC, in turn, oversees the assessment of information security, the creation of policies, standards, and procedures, as well as testing, training, and security reporting processes for our Company. Security Program.


text: Furthermore, our Board of Directors, both collectively and through its Risk Committee, holds responsibility for overseeing risk management, including cybersecurity risks. In this capacity, the Board and the Risk Committee, supported by management and third-party cybersecurity advisors, ensure that the risk management processes devised and executed by management are adequate and operational as intended. Annually, the Board reviews and approves our information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy, and business continuity planning policy. These policies are developed and implemented by our management team. To fulfill their duties, the Board receives regular updates from the Risk Committee regarding cybersecurity risks and management's endeavors to prevent, detect, mitigate, and address any cybersecurity incidents, at least quarterly.


text: Management and Strategy have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, hardware, software, third-party hosted services, and data.

companyName: MAYS J W INC

ticker: MAYS


text: We rely on third-party service providers to help manage our information systems, including network security service providers with experienced information technology professionals. We also work with third parties to identify, assess, and manage actual and perceived cybersecurity threats and risks, and we evaluate cybersecurity risk as part of our overall risk management strategy. With the assistance of these third-party service providers, we implement and maintain various technical, physical, and administrative controls and processes to manage and mitigate material risks from cybersecurity threats to our information systems. This includes procedures for incident detection and response, network security controls, access controls, physical security, systems monitoring, and backup and recovery procedures.


text: Our operations rely on third-party service providers and software programs. For instance, our accounting and financial reporting-related systems use software obtained from third-party service providers, and these systems are necessary for the efficient and consistent operation of our business. We use these systems to communicate with tenants, banks, vendors, and others, and to manage our accounting, financial reporting, and for other recordkeeping purposes. We, thus, maintain a process to identify and evaluate cybersecurity risks and incidents associated with key third-party providers. When utilizing third-party software for key services, we seek to engage those that are reliable, reputable, and maintain cybersecurity controls. To address risks associated with third-party providers for critical services, we review available audit reports of controls from such providers to assess and manage any identified risks.


text: Notwithstanding the effort we place on cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats or incidents which have materially affected or are likely to materially affect our Company, results of operations, or financial condition.


text: Board of Directors maintains oversight responsibility of risks from cybersecurity threats. This oversight is facilitated primarily through the Audit Committee (the "Committee"), which is responsible for oversight of our information system risk, including cybersecurity threats. The Committee oversees the risk management program designed to implement adequate controls to mitigate cybersecurity risks.


text: Committee receives periodic updates from management on potential risks, threats, and controls to mitigate identified risks. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: Our management, represented by our Chief Financial Officer, Ward Lyke, provides leadership for implementation and maintenance of our cybersecurity risk management processes. Mr. Lyke has served as Vice President, Chief Financial Officer, and Treasurer since January 2024, and as an Executive Vice President and Officer of the Company since 1984, including as Assistant Treasurer since 2003. Mr. Lyke currently manages the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Lyke oversees the Company's managed IT solutions service provider which includes, among other services: Business


text: Business continuity – Managed data backup utilizing best practices including cloud based disaster recovery, security protection – Real-time protection against security threats across email, browsers, files, and infrastructure resources, management – Patching for Windows and certain third party application updates, monitoring – 24x7 monitoring, alerting and maintenance of various office and cloud systems.


text: Lyke is notified real time by the managed service provider for matters requiring immediate attention. Mr. Lyke also reviews a standardized monthly report with key IT systems data and statistics, including red flags requiring resolution, if any. Management reports serious cybersecurity incidents to the Committee and our Board.


text: We depend heavily on various information systems and electronic resources to conduct our business operations. Additionally, a majority of our clients, service providers, and other business partners on whom we rely, including providers of our online banking, mobile banking, and accounting systems, utilize their own electronic information systems. Any of these systems are susceptible to compromise, whether by employees, clients, or other authorized individuals, as well as by malicious actors employing sophisticated and continuously evolving software, tools, and strategies. Given our status as a financial services provider and our relative size, we and our business partners are considered high-value targets for such malicious actors. For further details, please refer to the "Risks Related to Information Security and Business Interruption" section of the Risk Factors outlined in Item As a result, we have devoted significant resources to assessing, identifying, and managing cybersecurity risks and threats, including: Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program; Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements; Implementing multi-layered controls to avoid reliance on single controls; Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats; Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time; Managing and maintaining cybersecurity controls utilizing available people, processes and technology; Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers; Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;


text: The Information Security Program, overseen by our Executive Project and Technology Risk Committee ("EPTRC"), plays a vital role in our overall risk management system. It encompasses administrative, technical, and physical measures aimed at safeguarding the security and confidentiality of client records and information.


text: We also have an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response team (i) includes subject matter experts to address cyber threats and (ii) includes members of management responsible to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice.


text: Our management team is tasked with the daily management of the cybersecurity risks we encounter and supervises the EPTRC. Our EPTRC, in turn, oversees the assessment of information security, the creation of policies, standards, and procedures, as well as testing, training, and security reporting processes for our Company. The EPTRC is comprised of management with the appropriate expertise and authority to ensure effective oversight of the Information Security Program.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, hardware, software, third-party hosted services, and data.


text: Our operations rely on third-party service providers and software programs. For instance, our accounting and financial reporting-related systems use software obtained from third-party service providers, and these systems are necessary for the efficient and consistent operation of our business. We use these systems to communicate with tenants, banks, vendors, and others, and to manage our accounting, financial reporting, and for other recordkeeping purposes. We, thus, maintain a process to identify and evaluate cybersecurity risks and incidents associated with key third-party providers.


text: When utilizing third-party software for key services, we seek to engage those that are reliable, reputable, and maintain cybersecurity controls. To address risks associated with third-party providers for critical services, we review available audit reports of controls from such providers to assess and manage any identified risks.


text: Our Board maintains oversight responsibility of risks from cybersecurity threats. This oversight is facilitated primarily through the Audit Committee (the "Committee"), which is responsible for oversight of our information system risk, including cybersecurity threats. The Committee oversees the risk management program designed to implement adequate controls to mitigate cybersecurity risks.


text: The Committee receives periodic updates from management on potential risks, threats, and controls to mitigate identified risks. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on the cybersecurity risk management program as needed.


text: Our management, represented by our Chief Financial Officer, Ward Lyke, provides leadership for implementation and maintenance of our cybersecurity risk management processes. Mr. Lyke has served as Vice President, Chief Financial Officer, and Treasurer since January 2024, and as an Executive Vice President and Officer of the Company since 1984, including as Assistant Treasurer since 2003. Mr. Lyke currently manages key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Lyke oversees the Company's managed IT solutions service provider which includes, among other services:


text: Business continuity – Managed data backup utilizing best practices including cloud-based disaster recovery, Multi-vector security protection – Real-time protection against security threats across email, browsers, files, and infrastructure resources, Patch management – Patching for Windows and certain third-party application updates, Infrastructure monitoring – 24x7 monitoring, alerting and maintenance of various office and cloud systems.


text: Mr. Lyke is notified real time by the managed service provider for matters requiring immediate attention. Mr. Lyke also reviews a standardized monthly report with key IT systems data and statistics, including red flags requiring resolution, if any. Management reports serious cybersecurity incidents to the Committee and our Board.


text: The Company has developed an information security program to address material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.


text: The Company has a written incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and annually.


text: The Company has a Governance, Risk, and Compliance (GRC) function to address enterprise risks, and cybersecurity is a risk category addressed by that function.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Additionally, cybersecurity risks and threats that could have a material impact on the Company are discussed further in the Item 1A Risk Factors. Those sections of Item 1A should be read in conjunction with this Item 1C. Governance.


text: The Global Head of IT is the management position with primary responsibility for the development, operation, and maintenance of our information security program. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Company's IT infrastructure are appropriately secured and managed. It also encompasses ensuring that all employees are educated in IT best practices around incident management and security, ensuring the security of the internal and external IT systems, as well communicating to senior management and planning for future IT strategy and IT security.


text: The Company has an established Information Security Committee to manage the information security risk assessment framework. This framework includes a defined methodology and tolerable level of risk documented within the Information Security Management System ("ISMS") and relevant controls addressing business risks. The committee is informed of all security incidents and ensures appropriate remediation activities are implemented. The Company's ISMS are audited by both internal and external parties on a regular basis. Results of audits and material security incidents are presented to the Board of Directors on a quarterly basis.


text: The Company has established an information security program to address and mitigate material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. These policies and procedures undergo an annual audit to ensure compliance with ISO 27001 controls. A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.


text: The Global Director of Information Technology (GDIT) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The GDIT has over 25 years of experience as a security professional, and has completed the Prince 2 risk management certification at the practitioner level. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Company's IT infrastructure are appropriately secured and managed. It also encompasses ensuring that all employees are educated in IT best practices around incident management and security, ensuring the security of the internal and external IT systems, as well communicating to senior management and planning for future IT strategy and security.


text: Cybersecurity and risks associated with information security are operational risks included in the Company's ERM Framework. Under the ERM Framework, the Company's Information Security Risk and Compliance departments and all employees are the First Line. Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's Enterprise & Operational Risk Management Department is part of the independent risk oversight of information security risk along with the Company's ORMC and ERM Committee, both of which are management risk oversight committees. The Company manages the risk associated with information security in accordance with our Risk Appetite Statement, as approved by the BOD.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: The Risk Committee of the BOD and ORMC are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cyber security and information security. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the NIST for cybersecurity, the FFIEC examination guidelines, Control Objectives for Information and Related Technologies and the Information Technology Infrastructure Library frameworks, along with applicable privacy laws.


text: Information Security is the responsibility of the officers, employees and agents of the Company with oversight by the BOD. Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. Collectively, the Company's senior leadership in this area have nearly 80 years of experience. The Company's CISO has over 25 years of network architecture, information technology and cybersecurity experience, maintains Certified Information Systems Security Professional credentials and has served on the Federal Reserve Secure Payments Task Force. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD's Risk Committee is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CISO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy, from internal and external experts.


text: The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services, Swift and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.


text: The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC's recommendations on cyber preparedness, GLBA Safeguards Rule to protect user data, and Swift security control requirements. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to Center for Internet Security benchmarks for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.


text: Cybersecurity operational measures Led by our CISO, the Company's data protection, information, cyber and technology services team collaborates with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. The Company's SMC, which is part of the CISO organization, manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained SMC analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities, the SMC's oversight through SIEM, and with support of the Company's CSR Plan. The CSR Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The CSR Plan organizes resources to manage and resolve events that harm or threaten the security of information assets. The CSR plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The CSR plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.


text: As of the date of this report, other than the risks discussed in "Risk Factors," the Company knows of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity and risks associated with information security are operational risks included in the Company's ERM Framework. Cybersecurity risks may also include fraud, harm to employees or customers, violation of privacy or security laws and other legal risks, and reputational risk. These risks are all considered in the Company's ERM Framework as part of the Company's overall risk assessment process. Under the ERM Framework, the Company's Information Security Risk and Compliance departments and all employees are the First Line. Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's Enterprise & Operational Risk Management Department is part of the independent risk oversight of information security risk along with the Company's ORMC and ERM Committee, both of which are management risk oversight committees. The Company manages the risk associated with cybersecurity and information security in accordance with our Risk Appetite Statement, as approved by the BOD.


text: The Risk Committee of the BOD and ERM Committee are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cybersecurity and information security. The Audit Committee of the BOD oversees the audit control functions of which cybersecurity practices may be a part. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the NIST for cybersecurity, the FFIEC examination guidelines, Control Objectives for Information and Related Technologies and the Information Technology Infrastructure Library frameworks, along with applicable privacy laws.


text: Information Security is the responsibility of the officers, employees and agents of the Company with oversight by the BOD. Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. Collectively, the Company's senior leadership in this area have over 75 years of experience. The Company's CISO has over 25 years of network architecture, information technology and cybersecurity experience, maintains Certified Information Systems Security Professional credentials and has served on the Federal Reserve Secure Payments Task Force. The Company's CIO has over 30 years of technology executive leadership, technology experience focused on strategy, design, development, implementation and support of application systems, and overseeing transformative technology changes, including digital transformations and fraud and BSA/AML capabilities. While the CIO and information technology organizations collaborate with the CISO organization as described herein, to create independence between the CISO and CIO functions, the CISO reports to the Company's Chief Administration Officer and the CIO reports to the Company's Chief Banking Officer for National Business Lines. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD's Risk Committee is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CISO and CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy, from internal and external experts.


text: Cybersecurity assessment The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services, Swift and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.


text: Cybersecurity operational measures Operationally, the Company's overall cyber risk strategy is a collaborative process between the CIO and the information technology teams, and the CISO led data protection, information and cyber teams. The CIO oversees the establishment and implementation of the technical plan for cyber risk strategy which the CISO and his team reviews and critiques. After they have established a joint cyber risk plan, the Company's second line of defense reviews and challenges the plan. Thereafter, the CISO and CIO teams cooperate with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. As an ongoing operation, the Company's SMC, which is part of the CISO organization, manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained SMC analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities, the SMC's oversight through SIEM, and with support of the Company's CSR Plan. The CSR Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The CSR Plan organizes resources to detect, manage, respond to, resolve and recover from events that harm or threaten the security of information assets. The CSR plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The CSR plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.


text: Cyber threat actors and cybersecurity incidents are a reality and the Company and our third parties face cybersecurity threats in the normal course of business. As of the date of this report, we are aware of the incident described in Item 9B "Other Information" of this report and, as of the date of this report, we have not experienced material losses or consequences relating to material cybersecurity incidents experienced by us or our third parties. However, we expect businesses will continue to experience cybersecurity risks that could result in adverse impacts with increased frequency and severity due to the evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by third parties, will not have a material adverse impact on the Company, including its business strategy, results of operations and/or financial condition. Future cybersecurity threats and incidents could have a material impact on our service, systems or business and are discussed in "Risk Factors" to this report.


text: We recognize that cyber threats are constantly evolving, and we must stay ahead of risks and threats to our business systems, data, infrastructure, and employees. We take a holistic approach to cybersecurity to proactively mitigate and respond to cyber threats. Building a robust security program and security controls are critical components that are in the core foundation of our products, culture, and management oversight. As a financial transaction processor, we ensure security is embedded and regarded with importance across the organization and within our products and services. We recognize the criticality of maintaining the safety, security, and integrity of our systems and data to protect our customers, employees, partners, and shareholders. The security program and cybersecurity strategies are strongly supported by both executive management and our Board of Directors. Our executive management fosters a strong culture of security awareness and responsibilities from the tone at the top and across all functional teams at all levels. The security team leadership also conducts segment level Board and/or periodic meetings with segment business leadership to share security key performance indicators ("KPIs") and risk considerations, as well as align with business strategies and gain approval for financial support for cybersecurity resources and tools. Security leadership is also involved in financial forecasting for security needs and costs, and the Chief Technology Officer ("CTO") and Chief Financial Officer or executive management team is involved in understanding and approving security related investments and strategies. We invest in our cybersecurity personnel and protections to address critical risks to our infrastructure and systems, and we remain dedicated to continuous improvement in our cybersecurity program.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: The Company's CTO reports to our Chief Executive Officer and has been with Euronet 16 years and is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board of Directors (the "Board"). Many on our Information Technology ("IT") security team leadership have over a decade of cybersecurity and IT control experience, certifications, and external and internal IT audit experience. The Chief Information Security Officer ("CISO") reports to executive management independent of IT and is responsible for management of cybersecurity risk, security governance and compliance, security policies, security training, and the overall protection and defense of our networks, systems, and company data. The CISO manages the global security governance, risk, and compliance teams and is responsible for ensuring we meet our regulatory and compliance requirements as related to PCI DSS, ISO 27001, and other certifications we hold globally that support our business products and services. The Global Director of Cybersecurity reports to the CTO and manages our security toolbelt and implementations, incident response, alert management, and various technical security teams. The CISO and Global Director of Cybersecurity manage teams of cybersecurity professionals with broad experience and expertise, including PCI and other regulatory compliance, threat assessments and detection, forensic investigations, mitigation technologies, cybersecurity training, incident response, insider threats, third party risk, penetration testing, and security engineering expertise. Many members of the security leadership team across the organization have been with Euronet for more than 10 years. The global and segment security leadership teams work closely with legal, privacy, audit, and compliance teams to ensure we meet regulatory requirements and work together to address cyber risks in all functional areas of the organization. We also conduct strategic in person and virtual annual, quarterly, and monthly security meetings with key members of security and IT leadership to align on security priorities, initiatives, and requirements.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on our risk management process and the risk trends related to cybersecurity at least annually. The CTO attends all quarterly Board meetings and presents to the Board at a minimum of twice per year on security and cybersecurity KPIs and threat mitigations. The Audit Committee oversees risks including cybersecurity risks. Our internal audit team reports on cybersecurity risks and internal and external audit results to the Audit Committee. Internal Audit performs IT security and compliance audits for SOX 404 purposes, as well as testing Euronet's security standards, and performs pre-assessments for ISO 27001. We also engage third party independent assessments for penetration testing, vulnerability assessments, and certification such as PCI DSS, ISO 27001, VISA PIN and SOC Type 1 and Type 2 audits. The CTO and CISO also have weekly and monthly meetings with senior executive management to discuss security strategy, projects, and concerns. We have an established incident response process led by our CISO governing our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our Chief Executive Officer, executive management team, and the Board as well as regulatory notifications depending on the jurisdiction and specifications of the incident.


text: While we evaluate all security incidents and consider the materiality of individual or combined incidents, to date, no incidents or combination of incidents have materially affected the Company or our financial position, results of operations, and/or cash flows. We continue to invest in cybersecurity to enhance the design and effectiveness of our internal controls and processes to protect our systems, networks, and integrity of our data.


text: Risk Management and Policies - Our policies, standards, processes, and practices for assessing, identifying, and managing risks, including material risks, from cybersecurity threats are integrated into our overall security and risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and other applicable industry standards and best practices. We regularly review and update policies and procedures with input from IT and security leadership and industry security standards including PCI DSS and ISO. Business segments and local entities also maintain local policies and procedures that include global requirements and local, statutory, or contractual requirements and escalations. All employees must sign and acknowledge a Corporate Information Security Policy that outlines their responsibilities related to IT security, cybersecurity, and protection of company assets and data. In addition to the enterprise risk assessment presented to the Board, local entity IT and security teams maintain detailed risk assessments that are shared with local management and are provided for applicable regulatory requirements, as well.


text: Information Sharing and Collaboration - We subscribe to financial services cyber intelligence and collaboration services, and we work closely with cyber intelligence and managed security service providers to augment our own security program and controls. We investigate intelligence sharing platforms to assess potential risks as credible or emerging risks.


text: Continuous Monitoring – We have security team members across all of our geographic business operations that support our key IT processing centers. We have teams dedicated to investigating all security alerts and incidents at a global level or within our business segments. Further, we have managed security service providers who provide 24x7 advanced threat detection and monitoring services to augment our security analyst teams.


text: We have a global incident response policy that is shared with key stakeholders and outlines our classification, escalation, investigation, reporting, and overall response procedures depending on the classification and severity of incidents. Local IT teams must also create a local incident response plan and playbooks for addressing various types of incidents and handling escalations and reporting obligations locally. Further, we engage external forensic investigations as necessary to augment our incident reporting process if deemed critical and/or necessary for prompt response to security incidents which may require a higher technical level of forensics and/or resources to quickly assess and respond to certain incidents.


text: Training and Awareness - We provide security awareness training to our employees and contractors to help identify, mitigate, and report on cybersecurity threats. Our employees with network access must complete quarterly security awareness training which includes multiple interactive and video training modules with passing scores required to complete training compliance. We require annual PCI DSS and GDPR training as well as any other regulatory required security training. We also perform simulated phishing campaigns to further test security training effectiveness. We also periodically host tabletop exercises with IT and management to test and evaluate our incident response plan or playbooks.


text: Insider Threats - We implement insider threat controls designed to identify, assess, and address potential risks from within our Company. We implement controls and tools to alert on suspicious or unusual insider activity, and we have rigorous controls in place to prevent data loss and external sharing of company information. We consider and evaluate potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations.


text: Third Party Risk Assessments - We conduct information security assessments before sharing or allowing the hosting of data in computing environments managed by third parties or allowing third parties to connect to our environment. We also review and amend legal terms and conditions to ensure there are contractual provisions requiring certain security protections and incident reporting. We also perform vendor risk assessments to assess the risk of new and existing vendors we conduct business with.


text: External Assessments – We engage external assessors to evaluate, test, and conclude on the design and effectiveness of security controls and processes. We engage quality assessors for vulnerability and penetration testing as well as for security certification and/or regulatory requirements. Further, we have external audits performed by customers, banking and government regulators, and public accounting firms as part of financial and statutory audit purposes. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information on security and cybersecurity threats we face, please see "Risk Factors."


text: We have no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Profusa, Inc.

ticker: PFSA


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face

companyName: LAMF Global Ventures Corp. I


text: Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Longeveron Inc.

ticker: LGVN


text: The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Management and Strategy the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Governance:


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's Vice President, Business Operations ("VPBO"), other members of management and relevant management committees, including Company's Senior Leadership Team ("SLT"). The Company, as part of cost-cutting initiatives in 2024, has eliminated the VBPO position;


text: the obligations of that position as it relates to cybersecurity oversight and risk management will be undertaken by the Company's General Counsel.


text: The Company, through its information technology partner, has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: The Company, through its information technology partner, deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti- malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company, with its information technology partner, maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident.


text: The Company, through its information technology partner, provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company with our information technology partner regularly engages assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the VPBO who shares data with the SLT, Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The VPBO, in coordination with the SLT, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The VPBO and the SLT, through its information technology partner receives regular reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations. On an annual basis, the Audit Committee and the Board discuss the Company's approach to cybersecurity risk management with the members of the SLT, which includes the Company's VPBO, Chief Financial Officer ("CFO"), and General Counsel.


text: The VPBO, in coordination with the SLT, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the Company's information technology partner, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Company's SLT and Audit Committee, when appropriate.


text: The Company's information technology partner has worked in information technology and information security for over 30 years with over 300 employees with six locations in the United States. A virtual Chief Information Officer ("vCIO") from the partner works directly with the VPBO for align business and technical strategies, decisions, and implementations. The VPBO has over 35 years in the pharmaceutical and biotech industry managing programs and projects across a variety of implementation methodologies and risk factors and holds undergraduate degrees and certifications in his respective field. The Company's Chief Executive Officer, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including the results of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates.

companyName: BlueRiver Acquisition Corp.


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Advisor and other third-party service providers. The Investment Advisor manages our day-to-day operations and has implemented a cybersecurity program that applies to us and our business.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: The Investment Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us and to protect the systems, data and other digital assets of the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We rely on the Investment Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We rely on the Investment Advisor's risk management program and processes, which include cyber risk assessments.


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of the Investment Advisor when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Investment Advisor's Chief Operating Officer ("COO") and Chief Compliance Officer ("CCO") regarding the overall state of the Investment Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Our management, including the COO and CCO, is responsible for assessing and managing material risks from cybersecurity threats. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as operations management, IT management, oversight of third-party service providers and managing relationships with outside cybersecurity experts. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Advisor.


text: The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We closely follow the security industry and global threat trends, and our dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Our team consists of professionals with deep cybersecurity expertise across multiple industries, including our Information Security & Quality Manager. Our executive leadership team, along with input from the above professionals, are responsible for our overall enterprise risk management process and regularly consider cybersecurity risks in the context of other material risks to the Company.

companyName: Neonode Inc.

ticker: NEON


text: As part of our cybersecurity risk management system, we track and log privacy and security incidents across Neonode, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional team to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: The Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on


text: is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Company's overall risk management processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.


text: Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.


text: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Company's cybersecurity systems.


text: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events.


text: This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, CFO, and CISO, and CTO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO, CTO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CTO and CISO have served in various roles in information technology and information security for over 28 and 25 years respectively and hold relevant professional certifications. The Adviser's CCO and CFO, each hold undergraduate and graduate degrees in their respective fields, and each have over 15 and 28 years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


companyName: Kayne DL 2021, Inc.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, closely monitor emerging data protection laws and implement changes to our processes designed to comply; undertake regular reviews of our consumer facing policies and statements related to cybersecurity; proactively inform our customers of substantive changes related to customer data handling;


text: through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; maintain and follow an internal information security and incident response program;


text: follow common industry security standards, such as having two-factor authentication for all accounts, using corporate VPN for service minimize the period of time customers' personal information is stored in our database.


text: Our information security program coordinates the activities we take to prepare for, detect and respond to cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Where necessary, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. Please see the risk factor entitled " We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our products and data processed by us or third-party vendors. " in Part I, Item 1A. Risk Factors in this report for more information.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We have not been faced with any penalties or settlements related to cybersecurity.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: The audit committee of the Board is responsible for the oversight of risks from cybersecurity threats. Beginning fiscal year 2024, at least annually, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee will generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and will discuss such matters with our VP of Software Platform. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks will also be considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our VP of Software Platform. This individual has over 20 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs in the healthcare and robotics industries.


text: The VP of Software Platform is informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. The VP of Software Platform reports to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.


text: Our Information Security team manages our Information Security Program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity risk on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and our Board of Directors (the "Board"), as described below under the sub-heading " Governance."

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: To proactively manage cybersecurity risk in our organization, our management team has instituted an Information Technology Security Policy that is available to all employees through our Quality Management System. We also conduct regular cybersecurity awareness and training campaigns for existing employees.


text: Internal and external stakeholders can access Jasper's Information Technology helpdesk 24/7 online or by phone, to report any security incidents for escalation.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain a cyber incident response plan with formalized workflows and playbooks. We conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems and test our Information Technology infrastructure. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Security team identifies, and addresses known cybersecurity threats and incidents at third-party service providers on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.


text: Our risks associated with cybersecurity threats are set forth under " Risk Factors " in Part I, Item 1A in this report. Except as set forth therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: The Board, in coordination with the Audit Committee of the Board (the "Audit Committee"), oversees our risk management program, including the management of cybersecurity threats.


text: The Board and the Audit Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Audit Committee discuss our approach to overseeing cybersecurity threats with our CFO and other members of senior management. Our CEO, CFO and other members of our senior management collectively have several decades of experience managing risk at our company or similar companies and assessing cybersecurity threats.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: Thunder Power Holdings, Inc.

ticker: AIEV


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. As of the date of this report, we have not encountered any cybersecurity incidents since our IPO.